CELEX: 51992PC0422
Language: en
Date: 1992-10-15
Title: Amended proposal for a COUNCIL DIRECTIVE on the protection of individuals with regard to the processing of personal data and on the free movement of such data

COMMISSION OF THE EUROPEAN COMMUNITIES
                                        COM(92) 422 final - SYN 287
                                         Brussels, 15 October 1992
                    Amended proposal for a
                       COUNCIL DIRECTIVE
     on the protection of individuals with regard to the
    processing of personal data and on the free movement
                          of such data
   (presented by the Commission pursuant to Article 149(3)
                      of the EEC Treaty)
 ---pagebreak---                                     - 2 -
                           EXPLANATORY MEMORANDUM
                                 INTRODUCTION
On 18 July 1990 the Commission sent the Council a set of proposals,
including two directives and a decision, which were aimed at facilitating
the free movement of data in the Community; they sought to do this by
ensuring a high level of protection for individuals with regard to the
processing of personal data and by tightening the security of data
processing with particular consideration for the development of open
telecommunications networks.
The Economic and Social Committee delivered its opinion on the proposals on
24 April 1991 (OJ No C 159, 17 June 1991).
Parliament was consulted under the cooperation procedure, and its
committees studied the proposals in detail. On 10 February 1992 Parliament
considered the report of the Committee on Legal Affairs and Citizens'
Rights (the rapporteur was Mr Hoon), and on 11 March, virtually
unanimously, Parliament approved the proposals subject to numerous
amendments.
On 31 March the Council adopted the proposal for a Decision in the field of
security information systems (OJ No L 123, 8 May 1992).
The amended proposal put     forward here is intended to take account of
Parliament's opinion.
A. Main amendments
1. The approach to protection
   The amended proposal makes two major changes at Parliament's request:
   - it drops the formal distinction between the rules applying in the
      public sector and the rules applying in the private sector;
   - it expands the provisions on the procedures for notification to the
      supervisory authority and on codes of conduct.
   The amendments have the advantage of making it clear that the protection
   provided is the same in both the public and the private sectors.
   They also help to avoid excessive bureaucracy and make for greater
   convergence and equivalence between the methods used to ensure effective
   protection in the Member States, by clarifying the notification
   procedures and the terms of reference of the independent supervisory
    authorities in the light of the degree of danger which the processing of
    personal data may represent for the rights and freedoms of data
    subjects.
 ---pagebreak---                                    - 3 -
2. Concepts and definitions
   Parliament suggested that the concept of a "file" should be dropped, on
   the grounds that it was outdated and irrelevant given the development of
   automation and telecommunications, and that the collection of data
   should be included among the operations which would constitute
   "processing"   of   personal   data; after    considering   Parliament's
   amendments the Commission is now proposing that the subject-matter of
   the rules should in fact be the processing of personal data. This
   change has two advantages: the principles of protection laid down by the
   Directive are not dependent on a particular technology or form of
   organization; and the concept of the processing of data allows a general
   approach to be taken, with attention focusing on the data used and the
   whole sequence of operations carried out in the light of the objective
   in view.
   The Commission nevertheless considers it necessary to retain and clarify
   the concept of a "file", so that where processing is not automated the
   scope of the Directive can be restricted to personal data which are
   entered or intended for entry in such files.
   Lastly, the proposal now supplies a definition of the "third party" to
   whom personal data are disclosed.
3. Scope and specific exemptions
   The following amendments are proposed in response to Parliament's
   concerns. Their purpose is to guarantee and to reconcile the rights and
   freedoms involved, so as to ensure that data can move freely.
   (i)   The initial proposal would have excluded processing carried out by
         non-profit-making organizations from the scope of the Directive;
         this was criticized as inappropriate, and in line with certain of
         Parliament's amendments concerning the processing of sensitive
         data it is now proposed that processing of this kind should fall
         within the scope of the Directive, with provision for special
         exemption from the obligation to notify where necessary in order
         to guarantee freedom of opinion.
   (ii)  Where processing is carried out for purposes of journalism it is
         proposed that Member States should be required, rather than merely
         permitted, to lay down the exemptions necessary to reconcile the
         right of privacy with freedom of speech.
   (iii) Processing may involve no particular danger, and be carried out
         for example to satisfy a legal obligation, and it is proposed that
         there should be an exemption from the obligation to notify in such
         cases.
 ---pagebreak---                                     - 4 -
4. Third countries
   The rule intended to prevent the Community rulej from being circumvented
   in the course of transfers of data to non—Community countries takes the
   form of a ban on the transfer of data to countries which do not provide
    an adequate level of protection; this has now been clarified in order to
   remove any ambiguity as to the purpose pursued. Tests by which adequacy
    is to be measured have been added. Exceptions to the principle have
    also been laid down in a limited number of cases where particular
    circumstances appear to justify this.
B. Form and content of the amended proposal
The proposal has been restructured in order to take account of the dropping
of the formal distinction between the public and private sectors and the
expansion of the provisions on notification to the supervisory authority
which have already been referred to. The new structure is also intended to
provide a plainer exposition of the different components in the protection
mechanism. Lastly, it takes account of criticism of redundancy in the
initial version. This restructuring of the proposal affects Chapters II to
VI of the initial proposal; these are now for the most part grouped
together in a single Chapter II, which sets out all the general rules on
the lawfulness of the processing of personal data, one by one, in a new
order. The structure of Chapters I, VII and after have not been changed.
The new Chapter II is divided into sections, which lay down the principles
which are to govern the design and implementation of processing operations
carried out on personal data (Sections I, II and III), the data subject's
rights of information, access and objection (Sections IV, V and VI),
obligations    regarding   security   (Section VII),   and  procedures   for
notification to supervisory authorities (Section 8).
Section I sets out principles governing the quality of data to be
 processed; the principles are common to the laws of all Member States, and
derive from Council of Europe Convention No 108. Section I corresponds to
 Article 16 in the initial proposal. The inclusion of data collection in
 the definition of processing, which was asked for by Parliament has made a
 few drafting changes necessary. Parliament's request that data should be
 storable for academic purposes has also been met here.
 One of the principles listed in Section I, that data must be processed for
 a legitimate purpose, is clarified in Section II, which deals with the
 grounds for processing data. This Section reproduces and clarifies the
 exhaustive list of the various circumstances in which processing may be
 carried out, and gives it a general character. The list permits processing
 where the data subject has consented, or where a contract with the data
 subject makes it necessary, or to comply with a legal obligation, etc., and
 ends with a clause allowing private interests to be weighed against others.
 This balance-of-interest clause is likely to concern very different kinds
 of processing, such as direct-mail marketing and the use of data which are
 already a matter of public record; Member States are to weigh the balance
 of interest in accordance with procedures which they are to establish
 taking account in particular of the general principles in Section I and of
 the rights of data subjects.
 ---pagebreak---                                    - 5 -
Section III lays down specific rules governing types of processing which
might interfere with fundamental freedoms. In line with the Convention
already referred to and with Parliament's opinion, which has been followed
in part here, these rules provide for stricter protection where the data to
be processed are sensitive, that is to say relating in particular to
freedom of opinion. These provisions correspond to Article 17 in the
original   proposal. They   take   account   of  Parliament's   suggestions
particularly regarding processing carried out by associations of a
political or trade-union character. In the amended           proposal such
processing falls within the scope of the Directive, which allows the rights
of individuals to be guaranteed in this respect and the free movement of
such data to be ensured. Section 3 also sets out the rules already
referred to regarding processing for purposes of journalism, which are
intended to reconcile the two fundamental freedoms of privacy and freedom
of expression.
Section IV deals with the obligations of the controller to inform the data
subject of the processing which takes place. The obligations are intended
to ensure transparency in processing, and thus to underpin the principles
of the fair processing of data which are laid down in the Council of Europe
Convention, and which have already been referred to in Section I.
Section IV corresponds to what were Chapters II, III and IV in the original
version; the wording has been altered particularly in order to remove any
danger that it might be interpreted as requiring more information than is
necessary.
Section V concerns the data subject's right of access to data concerning
him and his right to have it rectified. It corresponds to certain
provisions of Chapter IV in the original proposal, and takes over
Parliament's amendments, which generally broaden the scope of this
entitlement (particularly the data subject's entitlement to be told the
source of the data being processed and the reasoning applied in any
automatic processing operation the outcome of which is invoked against
him). The amended provisions also take account of Parliament's request
that the circumstances in which the exercise of the right of access may be
restricted should be extended to the private sector on the same terms as
the public sector.
Section VI concerns the data subject's right to object on legitimate
grounds. It corresponds to the relevant provisions of Chapter III and IV
in the initial proposal. The requirement that data subjects must be
offered the possibility of opting out of the disclosure of data to third
parties with a view to canvassing is laid down here.
Section VII reproduces the rules on security which were set          out in
Chapter V of the initial proposal, with a few drafting changes.
 ---pagebreak--- Section VIII develops the original rules on notification. The selective
system proposed is for the most part taken over from Parliament's
amendments; it seeks to ensure that processing is transparent and that its
purposes are stated, while directing supervisory authorities' attention to
types of processing which deserve special attention because of the dangers
they involve. The system is based on the approach that all processing must
be notified to the supervisory authority once it is wholly or partly
automatic, although one notification may refer to a set of processing
operations whose purposes are linked from the point of view of the
controller or in terms of the data subject. On the basis of their
experience it is proposed that Member States may take measures to exempt
from the notification requirement processing operations which do not
represent any danger to the data subjects' rights and freedoms; they may
also simplify the requirement. Measures of this kind are to describe the
processing operations covered and where appropriate the circumstances in
which they are to be carried out. It is also proposed that the supervisory
authority may be empowered to examine notified processing operations before
they are carried out.
Chapter III groups together the provisions of Chapters IV and VII of the
initial proposal, dealing with the remedies open to data subjects,
liability, and penalties. These provisions have been amended to take
account of Parliament's opinion.
Chapter IV deals with transfers of personal data to non-member countries.
It corresponds to Chapter VIII of the initial proposal. It has been
amended in the way already indicated, and leaves scope for the Community to
develop a common policy on the subject.
Chapter V is concerned with codes of conduct.        It corresponds to the
relevant provisions in the original Chapter VI.     It follows Parliament's
opinion on the involvement of the independent supervisory authority in the
drawing up of codes of conduct.      It also allows Member States to give
trade associations a role in the application of the legislation by allowing
them to participate in drawing up national codes of conduct.
Chapter VI deals with the national supervisory authority and the
Working Party which is to help to ensure that the national provisions
adopted pursuant to the Directive are uniformly applied and to advise the
Commission.     The investigative powers of the national authorities are
clarified, as Parliament had hoped.    The composition of the Working Party
 has been left unchanged, in order to guarantee its independence.   For the
 same reason it is proposed that the Working Party should elect its own
 chairman.    The circumstances in which it is to be consulted by the
 Commission are spelt out.
 Chapter VII concerns the executive powers which the Council is asked to
 confer on the Commission.     Here the Commission maintains its initial
 proposal, contrary to Parliament's opinion.  The Commission takes the view
 that technical measures will be needed in order to apply the Directive,
 given the extent and the highly technical character of the field of
 personal data protection.
 ---pagebreak---                                    - 7 -
Final provisions: in response to Parliament's request the proposal now
provides that after the date by which Member States must comply with the
Directive there is to be a further period of three years in which the new
requirements need not apply to situations already existing.
 ---pagebreak---                                    - 8 -
                   COMMENTARY ON THE TITLE AND RECITALS
TITLE
Two points have been clarified in the title:
-  the words "and on the free movement of such data" have been added in
   order to emphasize that the proposal is aimed at establishing a working
   single market, on the basis of a harmonization of legislation which
   ensures the protection of individuals;
-  to eliminate any ambiguity as to the scope of the proposal it is made
   clear in the title that it is individuals who are to be protected, and
   not all persons both natural and legal (this change does not affect the
   English version).
RECITALS
The Commission has amended the recitals in order to take account of the
changes to the substantive provisions.
The following specific remarks may also be made:
   Recital No 2 is drawn from Parliament's opinion (amendment No 9), and
   seeks to point out the advantages of automatic data processing systems
   provided they respect individual rights and freedoms;
   it appeared preferable to place the recital referring to the Council of
   Europe Convention among those describing the requirements of a Community
   policy on the subject, because the Directive embodies the principles
   set out in the Convention; this recital has now become recital No 10;
   the same recital was previously placed among those dealing with
   transfers of data to non-member countries, as recital No 22;
   a new recital No 14 has been inserted which seeks briefly to summarize
   the principles of protection referred to in the succeeding recitals;
-  the changes in the new recital No 4 and recital No 5 are intended to
   amplify the description of the facts leading up to a Community
   initiative, the justification for which is then spelt out in
   recitals Nos 7 and 8.
 ---pagebreak---                                    - 9 -
                         COMMENTARY ON THE ARTICLES
CHAPTER I
GENERAL PROVISIONS
Article 1
Object of the Directive
Article 1 defines the object of the Directive. The Directive seeks to
ensure the free movement of personal data between Member States by
providing for a harmonization of national legislation.
(1)  Paragraph 1 requires Member States to protect the rights and freedoms
     of natural persons with respect to the processing of personal data,
     and in particular their right of privacy (the terminology is based on
     that of Article 1 of the Council of Europe Convention).
(2)  Under the Directive the protection provided is to follow the same
     lines in all Member States, and will thus be equivalent throughout the
     Community; and paragraph 2 accordingly prevents Member States from
     restricting the free flow of data in the fields covered by the
     Directive on grounds relating to the protection of data subjects.
The proposal thus seeks to reconcile the requirements of the single market
with those of data protection, in line with Parliament's wishes (amendment
No 10).
Parliament's amendment No 11 has likewise been incorporated into the
amended proposal, by enlarging the definition of "processing" in
Article 2(a) to include the collection of data.
Article 2
Definitions
This Article defines the main concepts used in the Directive. The
definitions are taken from the Council of Europe Convention, but have been
adapted and clarified to ensure equivalent protection at a high level in
the Community.
(a)  "Personal data". The amended proposal meets Parliament's wish that
     the definition of "personal data" should be as general as possible, so
     as to include all information concerning an identifiable individual
     (amendment No 12). A person may be identified directly by name or
     indirectly by a telephone number, a car registration number, a social
     security number, a passport number or by a combination of significant
     criteria which allows him to be recognized by narrowing down the group
     to which he belongs (age, occupation, place of residence, etc.). The
     definition would also cover data such as appearance, voice,
     fingerprints or genetic characteristics.
 ---pagebreak---                                - 10 -
"Depersonalized" data are not defined: the term is not used in the
Directive. This means that whether or not data are depersonalized no
longer depends on the cost of determining the data subject's identity
(amendment No 13). However, in the specific case where data are
compiled in the form of statistics, it has been considered appropriate
to state that they cannot be considered to be personal data where the
data subjects can no longer reasonably be identified.
"Processing of personal data" ("processing"). The definition given
here is likewise an extensive one, the better to ensure that
individuals are protected (amendment No 15), as it covers everything
from the collection to the erasure of data, including organization,
use, consultation, disclosure by transmission, dissemination or
otherwise    making   available  (amendment   No 16),   comparison   and
suppression.
"Personal data file" ("file"). This definition, which covers both
automatic and non-automatic files, is now clarified. In the case of
non-automatic processing it allows the scope of the Directive to be
confined to sets of data which are structured so as to facilitate
access and searches for data on individuals. Personal data which are
not organized so that they can be used with reference to the data
subjects themselves are thus excluded. In practice data of this kind
do not present the same dangers for individuals, and it is more
realistic not to subject them to the same obligations.
To ensure that individuals are properly protected the criteria for
access must have the "object or effect" of facilitating the use or
comparison of data. This means that the data subject has does not
have to prove intention, something which might have made it difficult
to apply the national legislation.
The word "comparison" has been preferred to "combination" because it
is appropriate both to automatic processing and to files kept on
paper.
"Controller". The definition is borrowed from the definition of the
"controller of the file" in the Council of Europe Convention.
 But as the Directive sets out to regulate the use of data in the light
of the object being pursued, it is preferable to speak of the
 "controller", and to drop any reference to a "file" or to "data".
The controller is the person ultimately reponsible for the choices
 governing the design and operation of the processing carried out
(usually a chief executive of the company), rather than anyone who
 carries   out   processing   in   accordance  with   the   controller s
 instructions. That is why the definition stipulates that the
 controller decides the "objective" of the processing. This is in line
 with Parliament's amendment No 17. The controller may process data
 himself, or have them processed by members of his staff or by an
 outside processor, a legally separate person acting on his behalf.
 ---pagebreak---                                   -li­
fe) "Processor". This   is  a  useful definition  proposed  by  Parliament
    (amendment No 18).
(f) "Third party". This definition is taken from one of Parliament's
    amendments (No 134); it has been reworded in the amended proposal in
    order to make it clear that third parties do not include the data
    subject, the controller, or any person authorized to process the data
    under the controller's direct authority or on his behalf, as is the
    case with the processor.
    Thus persons working for another organization, even if it belongs to
    the same group or holding company, will generally be third parties.
    On the other hand, branches of a bank processing customers' accounts
    under the direct authority of their headquarters would not be third
    parties. The same would apply to the employees of insurance
    companies; in the case of insurance brokers, on the other hand, the
    position may vary from case to case.
(g) "The data subject's consent". In the initial proposal the definition
    of a person's consent to the processing of data concerning him was
    given in Article 12, dealing with the rights of data subjects.
    This caused some confusion; some interested parties drew the
    conclusion that all processing required the prior consent of the data
    subject, whereas consent was only one of the possible grounds making
    processing lawful.
    It seems more logical, therefore, to put the rules on consent in
    Article 2, with a few changes of wording so as to cast them in the
    form of a definition.
    The reference to consent being "express" has been removed, lest it be
    interpreted as requiring written consent (a procedure confined to
    sensitive data in Article 8 of the amended proposal). It has been
    replaced by the concept of an "express indication of his wishes",
    something which may be either oral or in writing.
    The amended proposal makes it clear that consent must be "freely
    given", in cases where pressure might be brought to bear on the data
    subject (the case of a wage-earner and his employer, for example).
    To enable the data subject to make an assessment of the advantages and
    disadvantages of the processing of data concerning him, and to
    exercise his rights under Article 13 of the proposal (rectification,
    erasure and suppression), the consent given must be informed consent.
    The controller must supply the data subject with the information he
    needs, such as the name and address of the controller and of his
    representative if any (see Article 4(2)), the purpose of the
    processing, the data recorded, etc.
 ---pagebreak---                                    - 12 -
      The data subject's consent must be "specif i<~", meaning that it must
      relate to a particular data processing oper ι Ion concerning the data
      subject carried out by a particular controller and for particular
      purposes.
      The data subject may withdraw his consent at any time.       But this
      withdrawal has no retrospective effects; otherwise a processing
      operation which was lawful when carried out might become unlawful
      retroactively.
Three definitions in the original proposal have been deleted:
- the definition of the supervisory authority, which is covered by
    Article 32 of the amended proposal;
- the public and private sectors, as the provisions dealing with the two
    sectors have been merged (Chapter II of the amended proposal).
Article 3
Scope
Paragraph 1 of the amended proposal seeks to accommodate the views of those
who as far as data processing is concerned would like to refer only to
processing "by automatic means" (because automatic processing does not
necessarily require the existence of a file) and of those who are afraid
that the Directive might be extended to cover all data stored on paper,
whether structured or unstructured.
The amended proposal therefore lays down separate tests for determining the
scope of the Directive, depending on whether or not the data are being
 processed by automatic means: it is to apply to the non-automatic
 processing of data only if the data form part of a file; on the electronic
 side, however, the definition does not depend on the presence of a file,
 and the Directive applies to any automatic processing of data even if they
 do not form part of a file.
 Thus structured personal data are caught by the definition if they are
 organized in a manual file or by electronic data processing methods.
 The provision refers to processing "wholly or partly by automatic means in
 order to indicate that a processing operation constitutes a single whole
 even if only part (such as the index) is computerized.
 Paragraph 2 makes two exceptions:
 - the first exception concerns processing in the course of an activity
     which falls outside the scope of Community law (in the secret services
     for example); the scope of the Directive is defined in terms of the
     scope of Community law, so that it can evolve with it;
  - the second exception concerns the use of data in the course of a purely
     private activity, such as an electronic diary (amendment No 22);
 ---pagebreak---                                    - 13 -
   no other exceptions are laid down, because if too many types of
   organization were to be exempted from any obligation the rights of the
   individuals would no longer be guaranteed: while the rules governing
   certain types of processing of personal data may well be simplified (see
   Section VIII in Chapter II, on notification, which makes provision for
   exemption and simplification), a general exemption is not possible.
The particular problem of associations is dealt with in the Article
providing for the exemption of the collection of sensitive data (Article 8
in the amended proposal).
Article 4
National law applicable
This Article lays down the connecting factors which determine which
national law is applicable to processing within the scope of the Directive,
in order to avoid two possibilities:
   that the data subject might find himself outside any system of
   protection, and particularly that the law might be circumvented in order
   to achieve this;
- that the same processing operation might be governed by the laws of more
   than one country.
Under the original proposal the place where the file was located was to
determine territorial jurisdiction, but this criterion has not been
retained in the amended proposal, on the ground that the location of a file
or of a processing operation will often be impossible to determine:
processing operations may have more than one location and take place in
several Member States, particularly in the case of data bases connected to
networks, which are becoming increasingly frequent.
Under the amended proposal, therefore, the law applicable is defined by
reference to the place of establishment of the controller.
A controller who is not established in the Community, may for the purpose
of processing make use of means, whether or not automatic (terminals,
questionnaires etc.), which are located in the territory of a Member State,
and here the law applicable is to be that of the state on whose territory
those   means  are   located.    The    controller  must  then designate a
representative established in that Member State, who is to be subrogated to
the controller's rights and obligations.
In that case it is the representative who will be subject to the obligation
to notify (Section VIII of Chapter II); and any information regarding the
controller which has to be supplied to data subjects under the Directive
will   have to   be supplemented     by   information  on  the controller's
representative.
The amended proposal follows Parliament's amendment No 24 in removing the
reference to sporadic use, a vague term which would have been open to
various interpretations.
 ---pagebreak---                                    - 14 -
The reference to the place of establishment of the controller means that
the temporary removal of a file does not affect the law applicable.
Article 4(3) of the initial proposal has accordingly been dropped.
CHAPTER II
GENERAL RULES ON THE LAWFULNESS OF THE PROCESSING OF PERSONAL DATA
The structure of the amended proposal is different from that of the initial
proposal: the new Chapter II groups together all the rules, rights and
obligations which determine the lawfulness of processing operations.       In
line with Parliament's opinion, the provisions on the public and private
sectors have been run together.
Article 5
This Article takes over Article 6(2) and Article 8(1) and (3) of the
 initial proposal.      It requires Member States to provide that the
 processing of personal data is lawful only if carried out in accordance
 with Chapter II, which forms a whole.
 By way of explanation the Article also makes it clear that Member States
 may in their laws more precisely determine the circumstances in which
 processing is lawful, always subject to Chapter II. Depending on the
 particular area they might for example wish to determine the cases in which
 the interests of the data subject prevail (Article 7(f)), the methods by
 which information is to be given to data subjects (Section IV), or the way
 in which the right of objection is to be exercised (Section VI).        Such
 provisions may not stand in the way of the free movement of data within the
 Community.
 SECTION 1
 PRINCIPLES RELATING TO DATA QUALITY
  Article 6
 This Article takes over the thrust of Article 5 of the Council of Europe
  Convention.
  It contains the provisions concerning the fundamental rights of individuals
  with respect to data processing, and has been put at the beginning of the
  Chapter dealing with the lawfulness of processing operations. It will be
  necessary to refer back to this Article to interpret the subsequent
  Articles in the Chapter.
 ---pagebreak---                                   - 15 -
As compared with the Convention the Article makes several changes intended
to adapt the Convention's wording to the definitions in Article 2 of the
proposal, particularly the definition of "processing", and also to the
scope of the Directive, which unlike the Convention applies both to
automatic processing and to non-automatic processing of data contained in
files.
Article 6(1)(a) provides that personal data must be processed fairly and
lawfully. The "processing" referred to is that defined in Article 2(b),
and thus includes collection.
The rule laid down in Article 6(1)(a) excludes the use for example of
concealed devices which allow data to be collected surreptitiously and
without the knowledge of the data subject, by means of telephone tapping
and the like. This provision also prevents controllers from developing and
using clandestine processing operations for personal data.
Article 6(1)(b) states the principle of the purpose of the collection of
data (whether by automatic or non-automatic means). Personal data may be
stored only for specified, explicit and legitimate purposes.
The purpose of the collection of personal data must be "specified", that is
to say that the aim of the collection and use of data has to be defined in
as precise a fashion as possible. A general or vague definition or
description of the purpose of processing operations ("for commercial
purposes", for example) would not satisfy the requirement that the purpose
be specified.
The purpose must be specified before the data are collected. Where the
data are collected from the data subject. Article 11 requires that the
purpose must have been determined at the time of collect-ion.
A subsequent change in the purpose of a processing operation will be lawful
only to the extent that it is compatible with the initial purpose.
Article 6(1)(b) also obliges the controller to determine the purpose of the
storage and recording of data.
Personal data can be stored and used only for a "legitimate" purpose, so
that the potential purposes of processing are limited. A processing
operation may be designed and performed only for a purpose permitted by the
Directive and by the domestic legislation in the Member States.
Article 6(1)(c) states that data must be adequate, relevant and not
excessive in relation to the purposes for which they are processed. This
rule requires that the nature of the data should correspond to the end in
view.
Article 6(1)(d) is closely bound up with Article 6(1)(b) and (c). Data
must be accurate and, if necessary, kept up to date. If data are
inaccurate or incomplete given the purpose of the file, Article 6(1)(d)
provides that they are to be erased or rectified.
 ---pagebreak---                                    - 16 -
Article 6(1)(e) concerns the time for which personal data may be kept.
Data may be kept in a form which permits identification of data subjects
for no longer than is necessary to achieve the objectives for which the
data were recorded.
In some cases, however, where after a certain period a processing operation
is no longer needed for its primary function, it may be necessary to store
the    information,   particularly  for   historical  or   scientific   use.
Article 6(1)(e) therefore states that, as Parliament had requested
(amendment No 60), Member States may provide for further safeguards for
data stored for historical, statistical or scientific use, in order to
reconcile on the one hand the principle of the legitimate purpose and the
entitlement to have one's past forgotten and on the other hand the
requirements of research.
 Article 6(2) obliges the controller to ensure that the rules on the quality
of data laid down in Article 6(1) are complied with.
 SECTION II
 PRINCIPLES RELATING TO THE PROCESSING OF DATA
 Article 7
 Article 7 provides a simplified and restructured statement of the grounds
 on which personal data may lawfully be processed; in the initial proposal
 this matter was to be found in Articles 5, 6 and 8.
 The distinction between the public and the private sectors has been
 dropped, as proposed in Parliament's amendments Nos 27, 28 and 29.
 There is no longer any specific reference to the processing of data for a
 purpose other than the original one, a possibility covered                in
  Article 5(1)(b) of the initial proposal, or to the lawful disclosure of
  personal data, which was treated in Articles 6 and 8(2) of the original
  proposal. It is felt that the general rule that data must be used in a way
  compatible with the purpose for which it was collected, laid down in the
  new Article 6(l)(b), together with the statement of possible grounds for
  the processing of data, set out in the new Article 7, will be sufficient
  here.
  The criteria which Parliament proposed in its amendments No 30 and 32 have
  been accepted only in a modified form.
  Consent is no longer the main criterion, subject to exceptions; it is now
  the first of several alternatives (new Article 7(a)).
  The reference to a "quasi-contractual relationship" was considered by many
  sources to be vague and to fall either under the concept of a contract
  under that of a legitimate interest (referred to in the new Article 7(f));
  and the wording "steps at the request of the data subject preliminary to
  entering into a contract" has now been used to cover the situation before
  any contractual relationship is established (new Article 7(b)).
 ---pagebreak---                                    - 17 -
The reference to processing in order to comply with an obligation imposed
by national or Community law has been maintained (new Article 7(c)).
The same applies to the new Article 7(e) and in part to Article 7(f).
The new Article 7(d) has been added to provide for cases in which the data
subject has a vital interest in having his personal data processed but is
not in a position to give his consent (in serious medical cases for
example).
Article 7(f) has been drafted partly in response to Parliament's amendment
No 32; it expands the initial Article 8(1)(c), and takes into account the
fact that there may be legitimate interests at stake other than those of
the controller and of the data subject. Article 8(1)(b) of the initial
proposal has been deleted, because the Commission has established that in
certain cases the "sources generally accessible to the public" to which it
referred may in fact include sensitive personal data. In any event the
data will usually have been processed for specific purposes, and should not
be used for different purposes except in accordance with the other
provisions of the Directive.
SECTION III
SPECIAL CATEGORIES OF PROCESSING
Article 8
The processing of special categories of data
This Article corresponds to the original Article 17.
It is generally accepted that it is not so much the content of data which
may endanger privacy as the context in which the data is processed.
However, there is a broad consensus among the Member States that certain
categories of data do by their nature pose a threat to privacy. Article 8
of the proposed Directive therefore places strict limits on the processing
and use of data revealing racial or ethnic origin (which will include
information on skin colour); political opinions; religious, philosophical
or ethical persuasion, which will include the fact that a person holds no
religious belief, as well as information on any activities relating to such
a persuasion; trade-union membership; information on the data subject's
health, which will include his state of physical and mental health, past,
present and future, and any indication of drug or alcohol abuse; and
information   concerning  sexual    life. Beliefs    besides religious   or
philosophical beliefs might constitute sensitive data, and the word
"ethical" has been added accordingly.
The Article initially proposed has been amended and restructured to take
account of points raised by· Parliament (amendments Nos 63, 149 and 65).
 ---pagebreak---                                    - 18 -
paragraph 1 laya down a general ban on the processing of this "sensitive"
data - whether by manual or automatic means, a point included in response
to Parliament's amendment No 63.
paragraph 2 provides for a number of exceptions to the general rule:
  (i)   Rather than requiring "express and written consent, freely given" as
        a general condition for the processing of sensitive data, subject to
        exceptions, it is considered preferable to list consent as one of a
        number of alternative exceptions to the general prohibition on the
        processing of such data.
 (ii)   Such data may be processed by foundations or associations of a
        political, philosophical, religious or trade-union character in the
        course of their legitimate activities, and on condition that the
        data relate solely to members of the body and persons who have
        freely entered into correspondence with it, and are not disclosed to
        third parties. Processing of this kind is not to be subject to the
        obligation to notify imposed in section VIII of the amended
        proposal, something Parliament had requested in its amendment
        No 149.
(iii)   Processing may be carried out in circumstances where there is
        manifestly no infringement of the data subject's privacy or
        freedoms. Examples of processing of this kind would be the assembly
        of data of a political nature concerning a public representative, or
        the compilation of lists of persons to be approached for opinion
        poll purposes over a short period of time, under strict security
        measures.
Paragraph 3 reproduces Article 17(2) of the initial proposal, permitting
exemptions on "important public interest grounds." An exemption should be
given, for example, to international human rights organizations which
 require such data for their work, provided they can offer suitable
 safeguards.
 Parliament felt that data concerning criminal convictions should be held
 only by judicial authorities (amendment No 65), and this point has been
 accepted in part in paragraph 4. Such data could be held by judicial and
 law enforcement authorities, but also by the persons directly concerned
 with those convictions or by their representatives. Given the particularly
 sensitive nature of such data any exemptions would have to be laid down in
 legislation, with suitable safeguards specified.
 Parliament proposed a new Article 3a requiring Member States to enact the
 conditions under which a national identification number, where such a
 number exists, or other identifier of a general nature might be used
 (amendment No 65); this amendment has been accepted, and incorporated as
 paragraph 5.
 ---pagebreak---                                    - 19 -
Article 9
Processing of personal data and freedom of expression
This Article corresponds to the initial Article 19. There is a danger of
conflict between the fundamental rights of individuals, particularly the
right to privacy, and the freedom of expression, and the Member States are
here required to lay down exemptions from the requirements of the Directive
for the press and audiovisual media. The approach adopted lays emphasis on
the obligation to balance the interests involved in granting exemptions.
Account may be taken for example of the availability of remedies or of a
right of reply, the existence of a code of professional ethics, the limits
laid down by the European Convention on Human Rights, and the general
principles of law.
To ensure a measure of harmonization it is now to be obligatory for the
Member States to grant exemptions for the press, the audiovisual media, and
- an addition to the original text - journalists. Such exemption would be
possible only in respect of processing for journalistic purposes. The term
"journalists" is intended to include photojournalists and writers such as
biographers.
SECTION IV
INFORMATION TO BE GIVEN TO THE DATA SUBJECT
Section IV brings together all the provisions concerning the information to
be given to the data subject which were to be found loosely scattered in
the initial proposal (initial Articles 9, 13 and 14(3)).
Article 10
The existence of a processing operation
This Article corresponds to the initial Article 14(3), providing for the
right "to know of the existence of a file and to know its main purposes and
the identity and habitual residence, headquarters or place of business of
the controller of the file".
The following changes have been made.
It is specified that this entitlement may be exercised on request.
"Habitual residence, headquarters or place of business of the controller of
the file" have been replaced by the "name and address of the controller or
his representative", as these are felt to be sufficient particulars to
allow the data subject to exercise his rights. The data subject is now
also entitled to know the categories of data concerned and the identity of
any third parties.
Member States   may   restrict   this   entitlement   in  accordance   with
Article 14(1) on grounds of national security, defence, public safety,
etc.).
 ---pagebreak---                                     - 20 -
Article 11
Collection from the data subject
This Article grants specific information rights to a data subject from whom
personal data are collected; it corresponds to the initial Article 13.
If personal data are to be collected fairly and lawfully the data subject
must be able to decide whether or not to disclose data relating to him in
full knowledge of the purposes of the processing, the existence or
otherwise of a legal obligation to disclose the data, and the consequences
for him if he fails to reply. To ensure that he can defend his rights and
monitor the use of data relating to him he should also be informed of his
rights of access and rectification, and given details of the recipients of
the data.
The following changes have been made:
(i)     The title now specifies that it is when data are collected from the
         data subject that the Article applies.
(ii)     This is confirmed in paragraph 1, which makes it clear that what is
         involved is not just a right enjoyed by the data subject, to be
         exercised on request, but an obligation on the controller whenever
         personal data are collected from data subjects. How this is to be
         put into practice will depend on the particular circumstances in
         which the data are collected.
(iii)    Like Article 13(2) in the initial proposal, the new Article 11(2)
       ' empowers the Member States to restrict this duty to inform on
         grounds of an overriding general interest. The information referred
         to in paragraph 1 would not have to be supplied where that would
         hinder or prevent the performance of a monitoring or inspection
         function by a public authority or would hinder or prevent the
         maintenance of public order.
Article 12
Disclosure to a third party
This Article corresponds to Article 9 of the initial proposal. To enable
 the data subject to exercise his rights, paragraph 1 requires the
 controller to inform the data subject that data relating to him are being
 disclosed. This will enable the data subject to exercise his right of
 access or to object to a continuation of the processing in question.
 Parliament's amendment No 35 has been accepted to the extent that it
 referred to those provisions of amendment No 32 which have been accepted.
 The Article 8(2)(a) to which Article 35 referred corresponds to the
 Article 7(c) now referred to in Article 13; Article 8(2)(e) corresponds to
 the new Article 7(b), and Article 8(2)(g) partly corresponds to the new
 Article 7(f).
 ---pagebreak---                                   - 21 -
The data subject's right to object to processing operations, which include
disclosure, is dealt with in Section VI, Articles 15 and 16. The amended
Article 15 takes over the spirit of paragraph 3 of Parliament's amendment
No 35, omitting the concept of "agent", which was felt to be unnecessary
and confusing.
In the initial text the obligation to supply information when data are
disclosed essentially applied to the private sector, but the amended
proposal makes no distinction between the public and private sectors.
No reference is made to "on-line consultation", since this is covered by
the word "disclosure". The obligation to inform is not to apply:
   where disclosure is necessary in order to safeguard the data subject's
   vital interests (it may be impossible to inform him, or may be contrary
   to his interests to do so);
   where the data subject has already been informed that the data are to be
   disclosed or may be disclosed;
   where disclosure is required by legislation making an exception to the
   obligation to inform;
-  where the data are disclosed for one of the reasons listed in
   Article 14(1) (national security, defence, public safety, etc.).
It is felt that the data subject should be informed not only of the purpose
of the processing, the type of data concerned, and the name and address of
the controller or his representative, but also of the recipients or
categories of recipients, or the existence of rights of access,
rectification and objection.
Article 12(3) of the amended proposal corresponds to Article 10 of the
initial version, which made a special exception to the obligation to inform
the data subject where this proved impossible or would involve a
disproportionate effort, or conflicted with the overriding legitimate
interests of the controller of the file or a similar interest of a third
party. It is now added that a supervisory authority granting an exemption
of this kind must lay down any suitable safeguards; this is to ensure that
the data subject's rights and freedoms are not unduly injured by a lack of
information.
The power to exempt from the obligation to inform should be exercised, for
example, in respect of human rights and humanitarian organizations, so that
their legitimate work is not unduly hindered.
 ---pagebreak---                                    - 22 -
Article 13
Right of access
This Article includes those provisions of the initial Article 14 which
concerned the data subject's right of access to his own personal data and
the related right to obtain rectification, erasure or blocking of such data
(the original paragraphs 4, 5 and 7). Like Article 14(4) of the initial
text, the amended Article 13(1) confers on the data subject the right to
obtain, at reasonable intervals and without excessive delay or expense,
confirmation of the existence of personal data relating to him and
communication of such data to him in an intelligible form.
It is left to the Member States to specify how such information is to be
forwarded to the data subject, in order to ensure that the data are
disclosed to the right person, for example, or in order to facilitate
matters both for the controller and for the data subject where several
processing operations are concerned, especially in the case of manual
files. It is also left to the domestic law of the Member States to
determine the meaning of the term "reasonable intervals". Taking account
of the interests both of the data subject and of the controller, the
domestic law of the Member States may provide that the controller is
entitled to charge a data subject who exercises his right of access, but
the amount charged must be no more than the actual cost incurred. The
charge must not be excessive.
Article 13(1), corresponding to the old Article 14(4), has been amended in
the light of Parliament's amendment No 48, which has been accepted in part.
The right of access may be exercised on request. The data subject is to be
entitled to obtain information on the source of the data (rather than their
"general origin", a term which was felt to be too vague, and consequently
to serve no purpose), and general information on their use, rather than
 information on their "exact use" (a term which was felt to be excessively
 burdensome and bureaucratic). This provision also allows Member States to
 make special provision for access to medical data. To avoid exposing the
 data subject to extreme psychological shock it could be required that such
 information be provided to him by a medical practitioner.
 Article 13(2) has been added in response to Parliament's amendment No 132.
 It is directed against the misuse of the right of access, against the
 legitimate interests of the data subject (the example given by Parliament
 is that the data subject may not be required by any person to exercise his
 right of access as a precondition for employment or continued employment).
 But access in response to a demand by a third party may be required where
 the request is founded on national or Community law (an example would be
 certificates of marital status and the like, which might be requested in
 order to establish social security entitlements).
 Article 13(3), corresponding to the initial Article 14(5), gives the data
 subject the right of rectification, erasure or suppression of data if they
 have been processed in violation of the Directive. Minor changes have been
 made in order to render the amended text more precise, as Parliament had
 requested (amendment No 49).
 ---pagebreak---                                    - 23 -
Amendment No 49 has been accepted in part. "Data which have been wholly or
partially omitted" are here called "incomplete data", and are included.
But the amended text retains the terms "as the case may be" and "blocking"
or "suppression", which are surely useful.
For the sake of greater clarity the amended proposal uses the word
"suppression" rather than the initial proposal's word "blocking". The
concept is intended to cater for cases of data collected, stored, processed
or used in violation of the rules in the Directive: the controller may
continue to store them, but is prohibited from processing or using them,
and in particular from disclosing them to third parties. The suppressed
data have to be marked in the file in order to inform users of the file of
the suppression.
The words "as the case may be" leave the precise determination of the data
subject's entitlement to erasure, suppression or rectification in the
various situations in which personal data may be processed and used in
violation of the Directive to the data protection legislation of the Member
States.
Article 13(4) corresponds to the initial Article 14(7). This paragraph
makes provision for the data subject's interest in seeing third parties to
whom inaccurate or incomplete data have been disclosed notified of the
rectification, erasure or suppression so that they too can rectify, erase
or suppress the data.
Article 13(5) has been added as an additional safeguard where decisions are
taken by automatic means and produce results contrary to the data subject's
interests. In such a case the data subject has the right to be informed of
the reasoning used in the processing operation.
Article 14
Exceptions to the right of access
This   corresponds   to   the   initial   Article 15. It   authorizes   the
Member States to restrict the data subject's right of access to safeguard
an overriding public interest or an interest of another person where that
is equivalent to the data subject's right of privacy.
It is left to the Member States to determine whether and to what extent
they want to include restrictions based on Article 14 in their domestic
data protection legislation, unless they are obliged to do so under
Community law (e.g. under the rules on banking supervision or money
laundering). But the restrictions which the provision permits are limited
to those necessary to safeguard fundamental values in a democratic society,
and they must be adopted by legislation.
Parliament's amendment No 54 has been accepted. The amended Article 14 is
not confined to processing carried out by the public sector, but extends to
private sector processing too.
 ---pagebreak---                                     - 24 -
The 1 ist of the considerations justifying the restriction of access under
Article 14 which is set out in paragraph 1 is exhaustive.
The term "national security" is to be interpreted as meaning the protection
of national sovereignty against both internal and external threat.
"Criminal proceedings" covers the prosecution of crimes which have already
been committed, whereas the concept of "public safety" encompasses all the
policing functions of public authority, including crime prevention. The
phrase "substantial economic and financial interests of the Member State or
of the European Communities" refers to all economic policy measures and
measures to finance the policies of a Member State or the Community, such
as exchange controls, foreign trade controls, and tax collection. But only
a substantial interest of this kind would justify a restriction of the
right of access.
Lastly, other people's interests, including, where appropriate, those of
the controller himself, and other people's rights and freedoms are to be
considered valid grounds for restricting the right of access, provided they
are equivalent to the data subject's right of access. These would include
the trade secrets of others; the rules of confidentiality under which
lawyers and medical practitioners operate; a person's right to prepare his
or her own defence in court proceedings; and the protection of human
rights. The supervisory authority ought to be obliged to place
restrictions on data subjects' right of access to data relating to them
held by human rights organizations where unlimited access might endanger
other individuals (such as the sources of information which was provided in
confidence) or the overriding interests of such organizations.
If a data subject is denied access to data relating to him contained in a
file because an interest within the scope of Article 14(1) is invoked, the
data protection authority must, at his request, carry out the necessary
 inspections and checks on the file in which the data are stored; this
requirement was in the original proposal (Article 15(2)), and is now in
 Article 14(2). The object of the inspections and checks is to establish
 the lawfulness of any processing in the light of the Directive. When
 carrying them out, the authority must avoid harming the interests the
 safeguarding of which is provided for in paragraph 1.
 Article 14(3), which corresponds to the original Article 15(3), empowers
 the Me^nber States to place limits on the right of access to data which are
 compiled only temporarily, for the purpose of extracting statistical
 information; such operations represent only a minor threat to data
 subjects.
 ---pagebreak---                                    - 25 -
SECTION VI
THE DATA SUBJECT'S RIGHT TO OBJECT
Article 15
Objection on legitimate grounds
Article 15(1), which corresponds to Article 14(1) in the original proposal,
gives the data subject the right to object on legitimate grounds to the
processing of data relating to him. "Legitimate grounds" of the kind
referred to would include the absence of any legal justification for a
particular processing operation, for example because the grounds for
legitimate processing which are laid down in Chapter II of the Directive
are not met. On the other hand a data subject would not have legitimate
grounds for objecting to a legitimate processing operation which is
necessary to the performance of a contract between himself and the
controller.
Paragraph 2 reproduces Article 9(3) of the original proposal. Where there
is an objection in accordance with paragraph 1, the controller is required
to cease processing.
Paragraph 3 develops what was Article 14(6) in the initial proposal. Its
aim is to clarify the obligation of the controller with regard to data
subjects when he is authorized under other provisions of the Directive to
disclose data to third parties for the purposes of marketing by direct
mail. These obligations are to apply regardless of whether this is
commercial marketing or canvassing by a charitable organization or a
political party. The controller must satisfy himself that the opportunity
to have data erased without cost has been expressly offered to data
subjects before the data are disclosed. The same obligation is to apply
where data are not disclosed but are used for the same purposes by a
controller for the account of a third party. The controller may satisfy
his obligations in the course of his regular correspondence with data
subjects, without necessarily entering into specific correspondence.
The paragraph relates only to written mail. Measures to protect persons
against unwanted approaches made through telecommunications channels are
provided for in the amended proposal for a Directive in order to protect
individuals in the context of telecommunications networks.
 ---pagebreak---                                     - 26 -
Article 15
Automated individual decisions
The danger of the misuse of data processing in decision-making may become a
major problem in future: the result produced by the machine, using more and
more sophisticated software, and even expert systems, has an apparently
objective and incontrovertible character to which a human decision-maker
may attach too much weight, thus abdicating his own responsibilities.
Article 16(1) therefore lays down the principle that a person is not
obliged to accept a decision of a public administration or of a private
party which adversely affects him if it is based solely on automatic
processing defining a personality profile.
The version in the initial proposal has been rewritten in order more
closely to define the limited cases in which these provisions are to apply.
Three conditions must be satisfied:
   (i) The person must be subject to an adverse decision. The decision
       must be one which can be invoked against him, one which has
       consequences for him; thus the simple fact of sending a commercial
        brochure to a list of persons selected by computer is not a decision
        adversely affecting them for these purposes.
  (ii)  The decision must be taken solely by automatic processing: what is
        prohibited is the strict application by the user of the results
        nroduced by the system. Data processing may provide an aid to
        dec ision —making, but it cannot be the end of the matter; human
        judgment must have its place.
        It w*uld be contrary to this principle, for example, for an employer
        to reje-    an application from a job-seeker on the sole basis of his
        resu.ls in a computerized psychological evaluation, or to use such
        assessment; software to produce lists giving marks and classing job
        applicants in order of preference on the sole basis of a test of
        personality.
 (iii)  The processing must apply variables which determine a standard
        profile (considered good or bad) to the data concerning the data
        subject; this excludes all cases where the system does not define a
         personality profile: for example, the fact that a person is unable
        to obtain the sum of money he wants from an automatic cash dispenser
         because he has exceeded his credit limit would not fall inside this
         definition.
 A new paragraph 2 is added under which the share of human judgment required
 must be in proportion to the danger to the individual which would be
 represented by a decision which has been drawn up entirely by computer and
 which applies a personality profile to him.
 ---pagebreak---                                    - 27 -
One of Parliament's amendments (No 46) proposed that such a decision should
be allowed if the person consented, or where there was a contract or a
relationship of confidence approaching the state of a contract.
The amended proposal does not accept the criteria suggested; if the two
sides are not on equal terms (which is the case with a job-seeker, for
example) neither consent nor the hope of a contract provide a sufficient
safeguard.
Under paragraph 2 a data subject may be required to accept a decision of
the kind referred to in paragraph 1 if the decision is taken under a
contract between the data subject and the controller, or in the course of
the conclusion of such a contract, on condition that the data subject's
request is met, or that there are appropriate measures to safeguard his
legitimate interests (which the Member States are free to clarify). Such a
safeguard might be provided by law, by the notification procedures applied,
or by internal measures taken by the controller's organization.
Thus the use of scoring techniques with a view to the lending of money to
an individual is possible, if positive decisions to lend are based solely
on an automatic assessment of the risks; but where the score is negative
the legitimate interests of the data subject must be safeguarded, for
example by deferring a final answer until the organization has been able to
carry out a "flesh-and-blood" study of the case.
SECTION VII
SECURITY OF PROCESSING
Article 17
This Article corresponds to Article 18 of the initial proposal.
The potential danger to the data subject's right of privacy does not
emanate entirely from the controller, who collects, stores, processes and
discloses the individual's data for his own purposes.
The right of privacy is also jeopardized if the data subject's data are
misused by third parties who have gained unauthorized access to it.
Article 17 requires the Member States to oblige the controller to take
appropriate technical and organizational measures to protect data against
the danger of unauthorized intrusion by third parties, accidental or
unlawful destruction, accidental loss, unauthorized alteration or any other
unauthorized form of processing.
Parliament's amendment No 67 has been accepted in part. The initial
proposal's "automated files" has been replaced by "the automatic processing
of data". The reference to "the cost of taking the measures" has been
deleted. "Controller" is the term used throughout the amended text.
 ---pagebreak---                                    - 28 -
Some minor changes have been made for reasons of clarity. In paragraph 1,
"unauthorized destruction" has been replaced by "unlawful destruction" and
"unauthorized access" has been replaced by "unauthorized disclosure". In
paragraph 2 "adequate security" has been replaced by "an appropriate level
of security". In paragraph 3 "on-line consultation" has been replaced by
"an opportunity ... for remote access". Paragraph 4 now specifies that the
security obligations also apply to persons who share responsibility for
carrying out the processing, and in particular the processor.
There are two amendments of some substance. Where an opportunity is
provided for remote access, paragraph 3 now specifies that hardware and
software are to be utilized in such a way that access remains within the
 limits of the lawfulness of the processing (and not the limits of the
 authorization granted by the controller, which certainly would not exceed
 the limits of lawful processing, and is thus irrelevant for data protection
 purposes).
 Paragraph 5 makes an exception to the obligation not to disclose data to
 third parties without the controller's agreement: this may be done where it
 is required under national or Community law (in criminal investigations,
 for example).
 SECTION VIII
 NOTIFICATION
  Article 18
  Obligation to notify the supervisory authority
  Article 18 reproduces Articles 7 and 11 of the initial proposal, which
  dealt with the notification to the supervisory authority of files created
  in the public and private sectors. These provisions have now been merged,
  as Parliament suggested in its opinion. The presentation has the advantage
  of showing that the approach to notification is the same in whichever
  sector the data are processed.
   But the scope and content of the original provisions have been changed, in
  order to reflect Parliament's opinion and to ensure consistency in t e
   amended proposal. Under Parliament's amendments (Nos 39, 40, 41, 118 an
   199) the rules on notification are expanded in several articles.     η
   initial proposal notification was intended to ensure that Process^
   operations were a matter of record; it is now to serve as the basis fo
   selective monitoring of the legitimacy of processing operations y
   supervisory authority. Depending on the degree of danger they Posent,
   monitoring of processing operations will be carried out ex post,
   general rule, or in advance, in a limited number of cases.
 ---pagebreak---                                    - 29 -
1. Article 18(1) amends the obligation to notify laid down in the initial
   proposal as follows:
   (a) For the sake of consistency in the approach taken by the amended
       proposal, notification would now relate to "processing" rather than
       to a "file". This means that supervision will concentrate more on
       the use made of data, and the operations carried out on data for
       particular purposes (the nature of the operations, combinations,
       disclosures to third parties, the nature of the data collected,
       recorded, etc.), and less on the specific technical organization of
       the data in the file, which may be of no great significance for the
       protection of individuals once data are computerized.
   (b) The fact that data might be communicated, which in the initial
       proposal was a criterion for the presence of this obligation, has
       been omitted from the amended version in view of the criticisms put
       forward: it was argued that it was not a suitable test, as some
       cases of disclosure to third parties do not infringe the rights of
       individuals; and there was also the danger which might be presented
       by purely internal processing, aimed at selecting populations. It
       was considered preferable to extend the obligation to all processing
       of personal data before the processing takes place. This approach
       should encourage controllers to decide on the measures necessary to
       meet their obligations before they commence processing. But for a
       proper idea of the practical scope of this amendment account has to
       be taken of Article 19, on simplification of and exemption from the
       obligation to notify.
   (c) To ensure that monitoring can take account of the often varied
       totality of processing operations carried out by a controller, and
       to avoid inviting an excessive number of notifications, it is
       proposed that a single notification could cover a set of processing
       operations, whether or not repetitive, intended to serve a single
       purpose or several purposes which are related between themselves
       from the point of view of the controller and of the data subject.
       By way of example, a single notification would be required for all
       the processing operations concerning the management of loans given
       by a credit institutions: this might include registering the
       application, investigating it, approving it, recovering debts due
       and keeping track of legal proceedings.
   (d) So that administration need not become too burdensome, it is
       proposed that the obligation to notify would apply only to
       processing which is wholly or partly automatic, while leaving
       Member States free to extend this obligation to manual files under
       Article 21.
2. Article 18(2) gives further details of the content of the notification.
   (a) The clause referring to the category or categories of data subject
       has been added (examples might be the customers of the firm, the
       staff of the firm, recipients of this or that social benefit, etc.).
 ---pagebreak---                                 - 30 -
(b) Information regarding the third parties to whom data may be
     disclosed may take the form of a reference to categories of third
     party (Parliament's amendment No 39).
(c) For the description of the data to be processed, it will now be
     sufficient to list the categories of data, since too great a measure
     of technical detail will not significantly help an understanding of
     the process involved.
(d) The reference to the existence of transfers of data to non-Community
     countries has been added in order to facilitate the application of
     the special rules which are to govern them, and to ensure that their
     specific context is taken into account.
(e) The description of the security measures which was included in the
     initial proposal is retained here, given the importance of being
     able to monitor such measures, particularly in view of the
     development of remote processing using telecommunications networks.
 Article 18(3) concerns the notification of changes in the processing
 being carried out. The obligation to notify changes affecting the
 information in the earlier notification is retained from the initial
 proposal, so as to ensure that the list of processing operations which
 is accessible to the public is kept up to date, and that monitoring can
 continue, which is particularly important where the purposes of the
 processing are changed or where fresh groups of third parties may be
 given the data concerned.
 Article 18(4) and (5) reflect Parliament's opinion (amendments Nos 40,
 41, 118 and 199) that certain forms of processing may involve a special
 danger to the rights and freedoms of data subjects and should therefore
 be subject to a report or authorization from the supervisory authority
 before they are carried out.
  While fully acknowledging the variety of machinery which may be
  established in the various Member States, the Commission feels that
  Article 18(4) should require Member States to have such processing
  examined by the supervisory authority before it is carried out. Rather
  than a non-binding examination Member States are free to require
  authorization by legislation or by the supervisory authority.
  The "specific risks" referred to might have to do with the nature of the
  data to be processed, for example where the data is within the scope o
  Article 8; the scope of the processing, which might concern the whole
  population of a country; or the purpose in view, which might be to
  exclude data subjects from an entitlement, a benefit or a contract ( e
  case of a black list or an operation aimed at informing third parties
  on the solvency of individuals).
 ---pagebreak---                                   - 31 -
   Article 18(4) contains a clause intended to limit the time within which
   the supervisory authority must examine a case; this has been done in
   the controller's interest. The approach proposed in this Article should
   not   prevent Member States from taking measures to simplify the
   obligation to notify, or to grant exemptions from it, as provided in
   Article 19, on the basis of the experience they acquire.
5. For the sake of completeness it should also be pointed out that if a
   wholly or partly automatic processing operation is not covered by the
   simplification and exemption procedures provided for in Article 19, nor
   subject to prior examination, but is merely notified to the supervisory
   authority under Article 18, it will as a rule be subject only to ex
   post checking by the supervisory authority, as will the processing
   operations referred to in Article 19. Obviously the supervisory
   authority will satisfy itself that the notification procedure followed
   corresponds to the nature of the processing.
6. In line with the spirit of Parliament's opinion (amendment No 39) the
   Community procedures laid down in Articles 30 and 34 should allow
   harmonization of particular points where this is needed for the proper
   operation of the single market, with special reference to Articles 18
   and 19.
Article 19
Simplification of and exemption from the obligation to notify
Article 19 takes over and develops Parliament's amendment No 39, aimed at
simplifying procedures for certain categories of processing.
Article 19(1) proposes that Member States should be required to take such
measures; they would also be free to grant exemptions from the obligation
to notify.
In order to develop a coherent Community policy on the protection of
individuals, it is proposed that a criterion should be added, determining
the field in which it is proper to simplify and exempt from notification.
This refers to processing operations which are not liable adversely to
affect the rights and freedoms of data subjects.
Experience shows that a great many operations in which personal data are
processed in various organizations, large and small, public and private,
are of this nature, and thus do not require any detailed or general
notification. These may be forms of processing whose content and scope are
by nature strictly defined in legal terms, or simple forms of processing
whose legitimacy interest parties regularly have the opportunity to check,
or forms of processing which by nature cannot adversely affect data
subjects, or indeed forms of processing which are in fact of a more
sensitive nature but which in the particular context do provide the
necessary safeguards.
 ---pagebreak---                                    - 32 -
Article 19(1) corresponds to Parliament1 s amendment No 23, and proposes
that a processing operation should qualify for simplification or exemption
if its purpose is the production of correspondence or papers by word
processing, the satisfaction of legal, accounting, tax or social security
duties, or the consultation of documentation services accessible to the
public.
Member States are to permit simplified procedures and to grant exemptions
according to circumstances, in the light of their own experience and of the
specific character of processing operations, old and new, in their own
country. By way of example these measures might include the calculation of
the wages and salaries of the staff of a public body or private firm, some
kinds of    processing for scientific research purposes, and certain
operations concerning the medical records of patients held by a medical
practitioner or the like.
Article 19(2) takes over Parliament's amendment No 39, under which
simplification of the obligation to notify in the Member States had to be
the subject of a legal act. It is now proposed, however, in the spirit of
that amendment, that the drafting of a simplification or exemption measure
must involve the independent supervisory authority. And in order to ensure
that controllers are in a position to judge with safety whether any
processing    operations  they   envisage   are  in   accordance  with   the
simplification measure, it is proposed that the measure must describe each
category of processing operation covered, specifying the purposes, the data
or categories of data, the category or categories of data subject, the
third parties or categories of third party to whom the data are to be
disclcced, tne length of time the data are to be stored, and where
appropriate the conditions under which the processing is to be carried out.
Article 19(3) takes up the same amendment No 39; amendment No 39 also
sought: to ^-ke it clear that simplification or exemption from the
obligation :o .ot.ifv is not to release the controller from any of the other
obligations resulting from the Directive.
Article 20
 Manual processing operations
 Member States are left free to apply Section VIII to manual files, subject
to whatever adaptation may be necessary.
 Article 21
 Register of notified processing operations
 Article 21 corresponds to Article 7(1) of the initial proposal, under which
the supervisory authority was to keep a register of the public sector files
 notified to it, which was to be freely available for consultation. In the
 spirit of Parliament's opinion (amendments No 37 and No 39), Article 21 now
 extends this provision to all notified processing operations, regardless of
 the sector to which the controller belongs.
 ---pagebreak---                                    - 33 -
Consultation of the register may however be restricted, as Parliament
suggested, on the same grounds as are set out in Article 14(1), which deals
with the restriction of the right of access to data by the data subject.
In line with Parliament's opinion (amendment No 39), Article 21 lays down
the minimum content of entries in the register: they must include the
information referred to in Article 18(2), with the exception of measures to
ensure the security of processing, whose effectiveness would otherwise be
reduced.
CHAPTER III
JUDICIAL REMEDIES, LIABILITY AND PENALTIES
Article 22
Judicial remedies
Article 22 corresponds to Article 14(8) in the initial proposal. The scope
of the provision has been broadened. It is now proposed that national
legislation should provide data subjects with a judicial remedy which will
enable them where necessary to defend not only the additional rights listed
in Article 14 of the initial proposal but of all the rights given them by
the Directive.
Article 23
Liability
Article 23(1), like Article 21(1) in the initial proposal, places a
liability on the controller to compensate any damage caused to any person
as a result of a processing operation or any act incompatible with the
Directive. As Parliament requested in its opinion (amendment No 73),
liability is made to depend on "unlawful" processing. The concept of a
"file" is replaced by that of "processing". The change of wording means
that the content of paragraph 2 in Parliament's suggested version has in
fact been incorporated here. By speaking about "processing" the amended
proposal now includes the actual storage of personal data as a possible
source of liability, as Parliament had hoped.
But the Commission still feels that Member States should be free to exempt
from liability where suitable security measures have been taken. The
wording of the provision has been clarified. In view of Parliament's
opinion the Commission now specifies that a controller may be exempted in
whole or only in part.
 ---pagebreak---                                    - 34 -
Article 24
Processing by the processor
This Article corresponds to Article 22 of the original proposal. It aims
to ensure that the protection of the data subject is not deleted where
processing is carried out by a third party on the controller's behalf.
The Article uses the term "processor", which has been included in the list
of definitions at Parliament's suggestion. In accordance with Parliament's
wishes, paragraph 2 emphasizes that the processor may act only within the
terms of his contract with the controller. It is proposed that an express
 reference should be made to the obligations imposed by the national
 measures taken under the Directive, which will also apply to a processor.
 Article 25
 Penalties
 The changes made to the proposal here are intended to take account of
 Parliament's opinion (amendment No 77). They shift the accent to the
 persons who may be punishable. Penalties may in general be imposed on any
  person who does not comply with the national provisions adopted pursuant to
  the Directive, which may include, as Parliament points out in its opinion,
  authorities and organizations governed by public law.
  CHAPTER IV
  TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES
  Article 26
  Principles
   This Article corresponds to Article 25 in the initial proposal; it states
   that the transfer of personal data from a Member State to a non member
   country may take place only if the non-member country ensures an ^equa
   level of protection. Without such a provision the Community s e forts to
   guarantee a high level of protection for individuals could be nu          Y
   transfers to other countries in which the protection P^^dec
   inadequate. There is also the fact that free movement of data>       e
   Member States, which the proposal seeks to establish, will mean that
   will have to be common rules on transfer to non-Community countri .
 ---pagebreak---                                    - 35 -
In the course of consultation with interested parties it became clear that
in certain cases there would have to be exceptions to this principle. The
Commission has therefore reconsidered its initial proposal, in the light of
Parliament's opinion. It now proposes that the ban on transfers to
non-member countries which do not provide an adequate level of protection
should be subject to exceptions compatible with the protection of
individuals. Under the amended proposal, a transfer may be made to a
country which does not ensure an adequate level of protection if the data
subject has consented in order to take steps preliminary to entering into a
contract, or if the transfer is necessary for the performance of a contract
between the data subject and the controller. In such cases the data
subject must have been informed that it is or might be proposed to transfer
the data to such a country. The data subject may decide whether or not he
wishes to take such a risk. These exceptions seem particularly useful in
the case of data transfers linked to the transactions of banks or other
credit institutions. A transfer to a non-member country which does not
provide an adequate level of protection may also be justified if it is
necessary on important public interest grounds or in order to protect the
vital interests of the data subject. These exceptions are intended to
allow international cooperation (e.g. to combat money laundering or in
monitoring financial institutions) or to allow the transfer of medical
information in circumstances in which the data subject is unable to express
his wishes.
Paragraph 2 describes the tests to be applied to determine whether or not
protection is adequate. Account is to be taken of all the circumstances
surrounding a data transfer operation or set of data transfer operations,
such as the nature of the data, the purpose of the processing operations,
and the legislation in force in the other country. Both general and
sectoral legislative provisions will have to be examined here, along with
the question whether they are applied in practice, and any professional
rules laid down in codes of conduct. As Parliament suggested in its
opinion (see amendment No 79), the new paragraph 2 makes it clear that the
adequacy of protection is to be assessed with reference to a transfer of
data or a set of transfers of data.
Paragraph 3, which corresponds to Article 24(2) in the initial proposal,
has been amended in line with Parliament's opinion (amendment No 79), which
emphasizes that Member States are to assess the adequacy of protection and
to decide whether or not to ban data transfers accordingly. They are to
inform the Commission of such cases of prohibition.
As Parliament requested (amendment No 80), the Commission is to consult the
Working Party referred to in Article 32 before entering into negotiations
with a non-Community country; this is stipulated in paragraph 4, which
corresponds to the old Article 24(3).
 ---pagebreak---                                      - 36 -
Article 27
Particular measures
Article 27 reflects the intention of Article 25 of the initial proposal,
with some modifications. Under the new version a Member State may
authorize a transfer or category of transfers of personal data to a
non-member country which does not ensure an adequate level of protection if
the controller adduces sufficient justification guaranteeing the effective
 exercise of data subjects' rights, and if the other Member States or the
 Commission do not object to the measure envisaged in accordance with a
 procedure which the Article lays down. If an objection is made the
 Commission is to take appropriate measures, and may in particular decide to
 orohibit the transfer, to make it subject to additional conditions, or to
 enter into negotiations with the controller for whom the transfers are to
 be made in order to arrive at solutions for the whole Community.
  CHAPTER V
  CODES OF CONDUCT
  codes of conduct - the term generally used in other fields is the one
  employed in the amended proposal - were covered by Article 20 m the
  initial proposal. That provision aimed to encourage the drawing up of
  Community codes only. The amended proposal contains two Articles, one
  dealing with national codes and the other with Community codes.
   Article 28
   National codes
   Ration.        They also help to avo,d                              ^
                  °™ -ι-                                -~ι·ντ      rh have
   drawn tlL up, and so on.    But they .11 tave the follow^ features.
   - they ate drawn up voluntarily by a profession or trade, although they
       may be encouraged by the authorities;
    -  they apply or fill out the le,isl.tion applicable, but they „u.t regain
       within it;
                       • ^·       1-hirrt oarties, or on the courts, which may
    - they are not binding on third parti '                    legislation,
       always give priority to their own interpretation ot
 ---pagebreak---                                    - 37 -
Of course it may happen that the public authorities, and the legislature in
particular, themselves adopt a code drawn up by the trade, and give it
binding legislative force; this has happened in certain Member States.
To give such codes some authority, without changing their essential
characteristics, the Commission proposes that they should be submitted to
the competent national authority for its opinion; in doing this the
Commission is basing itself on the approach taken by Parliament in the case
of Community codes (amendment No 72).
It is therefore proposed that the supervisory authority should be asked to
check that codes are well thought out and that the trade associations which
drew them up are representative, and to ensure that codes are publicized,
to take the views of interested parties or their representatives, and to
deliver an opinion to be published alongside the code.
Article 29
Community codes
The amended proposal follows the lines of Parliament's opinion (amendment
No 72) and the provisions of Article 28, the powers given to the national
supervisory authority in the case of national codes being given here to the
Community working party on data protection. It will be for the Commission
to decide whether or not to publish codes together with the working party's
opinion for information purposes in the Official Journal.
CHAPTER VI
SUPERVISORY AUTHORITY AND WORKING PARTY
Article 30
Supervisory authority
This Article corresponds to Article 26 in the initial proposal; it provides
for the setting up of a supervisory authority, the essential feature of
which would be its independence. The Commission has accepted Parliament's
opinion (amendments Nos 84, 85, 86 and 87), and incorporated Parliament's
amendments into its own amended proposal.
(a)  Designation of supervisory authorities: Paragraph 1 makes it clear
     that  Member States   are  free   to  designate   several  independent
     supervisory authorities. This seems indispensable for Member States
     with a federal structure, and for Germany in particular.
(b)  Powers of supervisory authorities: In addition to the powers given to
     supervisory   authorities  by   the   provisions   already  discussed,
     particularly in connection with notifications, it is proposed that
     supervisory authorities should have powers of investigation and
     intervention in their dealings with controllers, under judicial
     control.
 ---pagebreak---                                    - 38 -
The supervisory authority's powers of investigation are intended to enable
it to collect from controllers the information it needs to perform its
duties. The authority would have access to the data being processed. In
order to preserve the rights of those subject to supervision by the
authority, obviously, these powers must be exercised in strict observance
of the confidentiality of the relevant data under national law. A
provision to this effect is inserted in paragraph 6.
To enable the supervisory authority to carry out its duties it must also
have effective powers of intervention, such as those enumerated by
Parliament in its opinion, and repeated in the amended proposal: power to
order suppression, erasure of data, a ban on the processing operation, etc.
Parliament referred to these measures as "sanctions", but it does not
appear necessary that the Directive should define their legal nature.
Lastly, it is proposed that the supervisory authority should have power to
bring an action before the courts where it finds that the national
provisions implementing the Directive have been infringed. The existing
systems of national legislation generally confer such a right. The right
follows logically from the power of investigation, as it is only reasonable
that an authority whose duty is to protect individuals should not set the
machinery of justice in motion where it finds an infringement of their
right to protection, and also from the right of any person to lodge a
complaint with the supervisory authority: the consequence of such a
complaint should indeed be a reference to the courts.
(c)   Annual reports: It is very important that the supervisory authority
      should be able to present a report on its activities at periodic
      intervals, pointing out any difficulties it has met in applying the
      legislation, and indicating the new approach to be taken.
 Article 31
 Working Party on the Protection      of  Individuals  with  regard  to  the
 Processing of Personal Data
 This Article corresponds to Article 27 in the initial proposal, and sets up
 a committee of the advisory type.
 (a)  Name of the working party
    It is proposed that the title of the working party be aligned on the
    wording in Article 1(1).
 (b)  Membership and chair
 The amendments requested by Parliament (amendments No 88 and No 128) are
 concerned mainly with the membership and chairmanship of the Working Party.
 In order to guarantee the working party's independence, a point it
 emphasized in the explanatory memorandum to the initial proposal, the
 Commission has accepted the suggestions in Parliament's opinion regarding
 the chairmanship of the working party, but not those regarding its
 membership.
 ---pagebreak---                                    - 39 -
  (i)  Chairmanship: the Commission is proposing that the working party
       should elect a chairman for a renewable term of two years. This
       term seems sufficiently long to ensure a measure of stability.
 (ii)  Membership: the Commission is maintaining its initial proposal that
       membership should be restricted to representatives of the national
       supervisory authorities already referred to. If some Member States
       make use of their freedom to designate more than one supervisory
       authority, it is proposed for the sake of fairness that those
       Member States should be represented by a joint representation on the
       working party. Otherwise the fact that a Member State had taken
       advantage of the freedom left to it by the preceding Articles might
       produce an unbalanced representation on the Working Party.
The Commission is asking that it should be represented on this working
party, and hopes that its own departments can provide the secretarial
services.
Article 32
Tasks of the Working Party
This Article defines the tasks of the Working Party. The Working Party
would continue to be an advisory body, as provided in the initial proposal.
It would advise the Commission, particularly when it was proposed that the
Commission should exercise its rule-making powers or put forward new
proposals. It would help to ensure that provisions adopted pursuant to the
Directive were applied in a uniform fashion, and also with the development
of a common policy on cross-border flows of data between the Community and
non-Community countries. The Commission would submit to the Working Party
any measure proposed in these fields with a view to obtaining its opinion.
The Working Party would act through opinions and recommendations submitted
to the Commission and possibly to the Advisory Committee. Here the
proposal accepts Parliament's opinion in part (amendments Nos 90, 91 and
92).
The Commission is to inform the Working Party of the action it has taken in
response to its opinions and recommendations, in a public report which is
to be transmitted to Parliament and to the Council.
The Commission shares Parliament's concern, expressed in amendment No 89,
that the secretariat of the Working Party should be allocated the necessary
funds to enable it to carry out the tasks given to it by the Directive. In
the budgetary procedure and elsewhere the Commission will seek to ensure
that the Working Party does have sufficient funding. But is does not
appear advisable to include a provision to this effect in the amended
proposal.
 ---pagebreak---                                   - 40 -
CHAPTER VII
RULE MAKING POWERS OF THE COMMISSION
Articles 33 and 34
Exercise of rule making powers and Advisory Committee
The Community maintains its initial proposal. Technical measures will be
needed to apply the Directive given the breadth and the highly technical
nature of the field of personal data processing.
FINAL PROVISIONS
Articles 35, 36 and 37
Article 35(2) proposes a transitional measure in line with what Parliament
suggested for notification (amendment No 37), namely that the provisions
adopted under the Directive should enter into force more slowly in respect
of processing operations which began before the date on which those
provisions enter into force. A three-year period seems sufficient.
As Parliament hoped (amendment No 95) it is proposed in Article 36 that the
regular report on the implementation of the Directive which the Commission
is to send the Council and Parliament should also be published.
 ---pagebreak---                                    - 41 -
PROPOSAL FOR A COUNCIL DIRECTIVE        AMENDED PROPOSAL FOR A COUNCIL
CONCERNING THE PROTECTION OF            DIRECTIVE ON THE PROTECTION OF
INDIVIDUALS IN RELATION TO THE          INDIVIDUALS WITH REGARD TO THE
PROCESSING OF PERSONAL DATA             PROCESSING OF PERSONAL DATA AND ON
                                        THE FREE MOVEMENT OF SUCH DATA
THE COUNCIL OF THE EUROPEAN             THE COUNCIL OF THE EUROPEAN
COMMUNITIES,                            COMMUNITIES,
Having regard to the Treaty             Having regard to the Treaty
establishing the European Economic      establishing the European Economic
Community and in particular             Community, and in particular
Articles 10OA and 113 thereof,          Articles 100a and 113 thereof.
Having regard to the proposal from      Having regard to the proposal from
the Commission,                         the Commission, (1)
In cooperation with the European        In cooperation with the European
Parliament,                             Parliament, (2)
Having regard to the opinion of the     Having regard to the opinion of the
Economic and Social Committee,          Economic and Social Committee, (3)
                                        (1) OJ No C 277, 5.11.1990, p. 3;
                                            OJ No C
                                        (2) OJ No C ...; OJ No C ...
                                        (3) OJ No C 159, 17.6.1991, p. 38.
 ---pagebreak---                                    - 42 -
(1) Whereas the objectives of the       (1) Whereas the objectives of the
Community, as laid down in the          Community, as laid down in the
Treaty, as amended by the Single        Treaty, as amended by the Single
European Act, include establishing      European Act, include establishing
an ever closer union among the          an ever closer union among the
peoples of Europe, fostering closer     peoples of Europe, fostering closer
relations between the States            relations between the States
belonging to the Community,              belonging to the Community,
ensuring economic and social             ensuring economic and social
progress by common action to             progress by common action to
eliminate the barriers which divide      eliminate the barriers which divide
Europe, encouraging the constant         Europe, encouraging the constant
improvement of the living                improvement of the living
conditions of its peoples,               conditions of its peoples,
preserving and strengthening peace       preserving and strengthening peace
and liberty and promoting democracy      and liberty and promoting democracy
on the basis of the fundamental          on the basis of the fundamental
rights recognized in the                 rights recognized in the
constitutions and laws of the            constitutions and laws of the
Member States and in the European        Member States and in the European
 Convention for the Protection of        Convention for the Protection of
 Human Rights and Fundamental            Human Rights and Fundamental
 Freedoms ;                              Freedoms;
 ---pagebreak---                                    - 43 -
                                        (2) Whereas data-processing systems
                                        are designed to serve society;
                                        whereas they must respect the
                                        fundamental freedoms and rights of
                                        individuals, notably the right to
                                        privacy, and contribute to economic
                                        and social progress, trade
                                        expansion and the well-being of
                                        individuals;
(2) Whereas the establishment and       (3) Whereas the establishment and
the functioning of an internal          the functioning of an internal
market in which, in accordance with     market in which, in accordance with
Article 8a of the Treaty, the free      Article 8a of the Treaty, the free
movement of goods, persons,             movement of goods, persons,
services and capital is ensured         services and capital is ensured
require not only that personal data     require not only that personal data
should be able to flow freely,          should be able to flow freely from
regardless of the Member States in      one Member state to another, but
which they are processed or             also that the fundamental rights of
requested, but also that                individuals should be safeguarded;
fundamental rights should be
safeguarded in view of the
increasingly frequent recourse in
the Community to the processing of
personal data in the various
spheres of economic and social
activity;
 ---pagebreak---                                    - 44 -
                                        (4) Whereas increasingly frequent
                                        recourse is being had in the
                                        Community to the processing of
                                         personal data in the various
                                        spheres of economic and social
                                         activity; whereas the progress made
                                         in information technology is making
                                         the processing and exchange of such
                                         data considerably easier;
(3) Whereas the internal market         (5) Whereas the economic and social
comprises an area without                integration resulting from the
frontiers; whereas, for that             establishment and functioning of
reason, the national authorities in      the internal market within the
the various Member Sttes are             meaning of Article 8a of the Treaty
increasingly being called upon, by       will necessarily lead to a
virtue of the operation of               substantial increase in cross-
Community lax, to collaborate and        border flows of personal data
exchange personal data so as to be       between all those involved in a
able to perform their duties or          private or public capacity in
carry out tasks on behalf of an          economic and social activity in the
authority in another Member State;       Member States; whereas the exchange
                                         of personal data between
                                         undertakings in different Member
                                         States is set to increase; whereas
                                         the national authorities in the
                                         various Member States are being
                                         called upon, by virtue of Community
                                         law, to collaborate and exchange
                                         personal data so as to be able to
                                         perform their duties or carry out
                                         tasks on behalf of an authority in
                                         another Member State within the
                                         context of the area without
                                         internal frontiers as constituted
                                         by the internal market;
 ---pagebreak---                                    - 45 -
(4) Whereas the increase in             (6) Whereas, furthermore, the
scientific and technical                increase in scientific and
cooperation and the coordinated         technical cooperation and the
introduction of new                     coordinated introduction of new
telecommunications networks in the      telecommunications networks in the
Community necessitate and               Community necessitate and
facillitate cross-border flows of       facilitate cross-border flows of
personal data;                          personal data;
(5) Whereas the difference in           (7) Whereas the difference in
levels of protection of privacy in      levels of protection of the rights
relation to the processing of           and freedoms of individuals,
personal dat afforded in the Member     notably the right to privacy, with
States may prevent the transmission     regard to the processing of
of such data from the territory of      personal data afforded in the
one Member State to that of another     Member States may prevent the
Member State; whereas this              transmission of such data from the
difference may therefore constitute     territory of one Member State to
an obstacle to the pursuit of a         that of another Member State;
number of economic activities at        whereas this difference may
Community level, distort                therefore constitute an obstacle to
competition and impede authorities      the pursuit of a number of economic
in the discharge of their               activities at Community level,
responsibilities under Community        distort competition and impede
lax; whereas this difference in         authorities in the discharge of
levels of protection is due to the      their responsibilities under
existence of a wide variety of          Community law; whereas this
national laws, regulations and          difference in levels of protection
administrative provisions;              is due to the existence of a wide
                                        variety of national laws,
                                        regulations and administrative
                                        provisions;
 ---pagebreak---                                    - 46 -
(6) Whereas in order to remove the      (8) Whereas, in order to remove the
obstacles to floxs of personal           obstacles to flows of personal
data, the level of protection of         data, the level of protection of
privacy in relation to the               the rights and freedoms of
processing of such data must be          individuals with regard to the
equivalent in all the Member             processing of such data must be
States; whereas to that end it is        equivalent in all the Member
 necessary to approximate the            States; whereas this objective is
 relevant laws;                           vital to the internal market but
                                          cannot be achieved by the Member
                                          States alone, especially in view of
                                          the scale of the divergences which
                                          currently exist between the
                                          relevant laws in the Member States
                                          and the need to coordinate the laws
                                          of the Member States so as to
                                          ensure that the cross-border flow
                                          of personal data is regulated in a
                                          consistent manner that is in
                                           keeping with the objective of the
                                           internal market as provided for in
                                           Article 8a of the Treaty; whereas
                                           Community action to approximate
                                           those laws is therefore needed;
 ---pagebreak---                                    - 47 -
(7) Whereas the object of the           (9) Whereas the object of the
national laws on the processing of      national laws on the processing of
personal data is to protect             personal data is to protect
fundamental rights, notably the         fundamental rights and freedoms,
right to privacy which is               notably the right to privacy, which
recognized both in Article 8 of the     is recognized both in Article 8 of
Convention for the Protection of        the European Convention for the
Human Rights and Fundamental            Protection of Human Rights and
Freedoms and in the general             Fundamental Freedoms and in the
principles of Community law;            general principles of Community
whereas, for that reason, the           law; whereas, for that reason, the
approximation of those laws must        approximation of those laws must
not result in any lessening of the      not result in any lessening of the
protection they afford but must, on     protection they afford but must, on
the contrary, seek to ensure a high     the contrary, seek to ensure a high
level of protection in the              level of protection in the
Community;                              Community;
(22) Whereas the principles             (10) Whereas the principles of the
contained in this Directive give        protection of the rights and
substance to and amplify those          freedoms of individuals, notably
contained in the Council of Europe      the right to privacy, which are
Convention of 28 January 1981 for       contained in this Directive, give
the Protection of Individuals with      substance to and amplify those
regard to Automatic Processing of       contained in the Council of Europe
Personal Data;                          Convention of 28 January 19 81 for
                                        the Protection of Individuals with
                                        regard to Automatic Processing of
                                        Personal Data;
 ---pagebreak---                                    - 48 -
(9) Whereas the protection              (11) Whereas the protection
principles must apply to all data        principles must apply to all
files where the activities of the        processing of personal data by any
controller of the file are governed      person whose activities are
by Community law; whereas public-        governed by Community law; whereas
sector files which are not governed      processing carried out by a Member
by Community law should, as is           State's own authorities,
provided for in the resolution of        organizations or other bodies in
the representatives of the               the course of activities which are
Governments of the Member States of      not governed by Community law
the European Communities meeting         should, as is provided for in the
within the Council of ..., be            Resolution of the representatives
subject to the same protection           of the Governments of the Member
principles set forth in national         States of the European Communities
laws; whereas, however, data files       meeting within the Council of ...,
falling exclusively within the           be subject to the same protection
confines of the exercise of a            principles set out in national
natural person's right to privacy,       laws; whereas processing carried
such as personal address files,          out by a natural person for purely
must be excluded;                        private purposes in connection, for
                                         example, with correspondence or the
                                         maintenance of lists of addresses
                                         must be excluded;
 ---pagebreak---                                    - 49 -
10) Whereas any processing of           (12) Whereas, in order to ensure
personal data in the Community          that individuals are not deprived
should be carried out in accordance     of the protection to which they are
with the law of the Member State in     entitled under this Directive, any
which the data file is located so        processing of personal data in the
that individuals are not deprived        Community must be carried out in
of the protection to which they are      accordance with the law of one of
entitled under this Directive;           the Member States; whereas, in this
whereas, in this connection, each        connection, processing carried out
part of a data file divided among        by a person who is established in a
several Member states must be            Member State should be governed by
considered a separte data file and       the law of that State; whereas, the
transfer to a non-member country         fact that processing is carried out
must not be a bar to such                by a person established in a third
protection;                              country must not stand in the way
                                         of the protection of individuals
                                         provided for in this Directive;
                                         whereas, in that case, the
                                         processing should be governed by
                                         the law of the Member State in
                                         which the means used are located,
                                         and there should be guarantees to
                                         ensure that the rights and
                                         obligations provided for in this
                                         Directive are respected in
                                         practice ;
 ---pagebreak---                                    - 50 -
(12) Whereas  national laws may,        (13) Whereas Member States may more
under the conditions laid down in        precisely define in the laws they
this Directive, specify rules on        enact or when bringing into force
the lawfulness of processing;            the measures taken under this
whereas, however such a possibility      Directive the general circumstances
cannot serve as a basis for              in which processing is lawful;
supervision by a Member State other      whereas, however, more precise
than the State in which the data         rules of this kind cannot serve as
file is located, the obligation on       a basis for supervision by a Member
the part of the latter to ensure,        State other than the Member State
in accordance with this Directive,       of residence of the person
the protection of privacy in             responsible for the processing,
relation to the processing of            since the obligation on the part of
personal data being sufficient,          the latter to ensure, in accordance
under Community law, to permit the       with this Directive, the protection
free flow of data;                       of rights and freedoms with regard
                                         to the processing of personal data
                                         is sufficient, under Community law,
                                         to permit the free flow of data;
                                         (14) Whereas the principles of
                                         protection must be reflected, on
                                         the one hand, in the obligations
                                         imposed on persons, public
                                         authorities, enterprises or bodies
                                         carrying out processing, in
                                         particular regarding quality,
                                         technical security, notification to
                                         the supervisory authority, and the
                                         circumstances under which
                                         processing is admissible, one such
                                         possible circumstance being that
                                         the data subject has consented,
                                         and, on the other hand, in the
                                         rights conferred on individuals,
                                         the data on whom are the subject of
 ---pagebreak---                                   - 51 -
                                        processing, to be informed that
                                        processing is taking place, to
                                       consult the data, to demand
                                       corrections and even to object to
                                        processing;
                                       (15) Whereas any processing of
                                        personal data must be lawful and
                                       fair to the person concerned;
                                       whereas, in particular, the data
                                        must be relevant and not excessive
                                        in relation to the purposes for
                                       which they are processed; whereas
                                        such purposes must be explicit and
                                        lawful;
(11) Whereas any processing of         (16) Whereas, in order to be
personal data must be lawful;           lawful, the processing of personal
whereas such lawfulness must be         data must be carried out with the
based on the consent of the data        consent of the data subject or with
subject or on Community or national     a view to the conclusion or
law;                                    performance of a contract, binding
                                        on the data subject,  or be
                                        required by Community law, by
                                        national law, by the general
                                        interest or by the interest of an
                                        individual, provided that the data
                                        subject has no legitimate grounds
                                        for objection; whereas, in
                                        particular, in order to maintain a
                                        balance between the interests
                                        involved, while guaranteeing
                                        effective competition, Member
                                        States remain free to determine the
                                        circumstances in which personal
 ---pagebreak---                                    - 52 -
                                        data may b<= disclosed to a third
                                        party for mailing purposes or
                                        research being carried out by an
                                        organization or other association
                                        or foundation, of a political
                                        nature for example, subject to the
                                         provisions allowing a data subject
                                        to object to the disclosure of data
                                        regarding him, at no cost and
                                        without having to state his
                                         reasons;
(16) Whereas, if data are to be         (17) Whereas data which are capable
processed, they must fulfil certain      by their nature of infringing
requirements; whereas the                fundamental freedoms or privacy
processing of data which are             should not be processed unless the
capable by their very nature of          data subject gives his written
infringing the right to privacy          consent; whereas, however,
must be prohibited unless the data       processing of these data must be
subject gives his explicit consent;      permitted if it is carried out by
whereas, however, on important           an association the purpose of which
public interest grounds, notably in      is to help safeguard the exercise
relation to the medical profession,      of those freedoms; whereas, on
derogations may be granted on the        grounds of important public
basis of a law laying down               interest, notably in relation to
precisely and strictly the               the medical profession, exemptions
conditions governing and limits to       may be granted by law or by
the processing of this type of           decision of the supervisory
data;                                    authority laying down the limits
                                         and suitable safeguards for the
                                         processing of these types of data;
 ---pagebreak---                                    - 53 -
(18) Whereas as regards the media       (18) Whereas the processing of
the Member States may grant             personal data for purposes of
derogations from the provisions of      journalism should qualify for
this Directive in so far as they        exemption from the requirements of
are designed to reconcile the right     this Directive wherever this is
to privacy with the freedom of          necessary to reconcile the
information and the right to            fundamental rights of individuals
receive and impart information, as      with freedom of information and
guaranteed, in particular, in           notably the right to receive and
Article 10 of the Convention for        impart information, as guaranteed
the Protection of Human Rights and      in particular in Article 10 of the
Fundamental Freedoms;                   European Convention for the
                                        protection of Human Rights and
                                        Fundamental Freedoms;
(14) Whereas the data subject must,     (19) Whereas, if the processing of
if his consent is to be valid and       data is to be fair, the data
when data relating to him are           subject must be in a position to
collected from him, be given            learn of the existence of a
accurate and full information;          processing operation and must be
                                        given accurate and full information
                                        where data are collected from him,
                                        and not later than the time when
                                        the data are first disclosed to a
                                        third party if the data subject was
                                        not informed at the time the data
                                        were collected;
(15) Whereas the data subject must      (20) Whereas any person must be
be able to exercise the right of        able to exercise the right of
access in ordre to verify the           access to data relating to him
lawfulness of the processing of         which are being processed, in order
data relating to him and their          to verify the accuracy of the data
quality;                                and the lawfulness of the
                                        processing; whereas, therefore, any
                                        person should be entitled to object
                                        to the processing of the data on
                                         legitimate grounds;
 ---pagebreak---                                    - 54 -
(17) Whereas the protection of          (21) whereas the protection of the
privacy in relation to personal         rights and freedoms of data
data requires that appropriate          subjects with regard to the
security measures be taken, both at      processing of personal data
the level of design and at that of      requires that appropriate technical
the techniques of processing, to        measures be taken, both at the time
prevent any unauthorized                 of the design of the techniques of
processing;                              processing and at the time of the
                                         processing itself, particularly in
                                         order to maintain security and
                                         thereby to prevent any unauthorized
                                         processing;
13) Whereas the procedures of            (22) Whereas the notification
notification, in respect of public-      procedures are designed to ensure
or private-sector data files, and        disclosure of the purposes and main
provision of information at the          features of any processing
time of first communication, in          operation, for the purpose of
respect of private-sector data           verification that the operation is
files, are designed to ensure the        in accordance with the national
transparency essential to the            measures taken under this
 exercise by the data subject of the     Directive; whereas, in order to
right of access to data relating to      avoid unsuitable administrative
 him;                                    formalities, exemption from the
                                         obligation to notify and
                                         simplification of the notification
                                         required must be provided for by
                                         Member States in cases where
                                          processing does not adversely
                                          affect the rights and freedoms of
                                          data subjects provided that it is
                                          in accordance with a measure taken
                                          by a Member State and specifying
                                          its limits;
 ---pagebreak---                                    - 55 -
                                        (23) Whereas ex post facto
                                        verification by the competent
                                        authorities must, in general, be
                                        considered a sufficient measure;
                                        whereas, however, Member States
                                        must provide for checking by the
                                        supervisory authority prior to any
                                        processing which poses a particular
                                        threat to the rights and freedoms
                                        of data subjects by virtue of its
                                        nature, scope or purpose, such as
                                        processing which has as its object
                                        the exclusion of data subjects from
                                        a right, a benefit or a contract;
                                        whereas Member States should be
                                        entitled to replace such prior
                                        checking by means of a legislative
                                        measure or a decision of the
                                        supervisory authority authorizing
                                        the processing operation and
                                        specifying suitable safeguards;
(20) Whereas, in the event of non­      (24) Whereas, if the person
compliance with this Directive,         carrying out processing fails to
liability in any action for damages     respect the rights of data
must rest with the controller on        subjects, national legislation must
the file; whereas dissuasive             provide for a judicial remedy;
sanctions must be applied in order      whereas any damage which a person
to ensure effective protection;         may suffer as a result of unlawful
                                         processing must be compensated for
                                         by the person responsible for the
                                         processing, who may be exempted
                                        from liability only if he proves
                                        that he has taken suitable security
                                         measures;
 ---pagebreak---                                    - 56 -
                                        whereas dissuasive penalties must
                                         be imposed on any person, whether
                                         governed by private or public law,
                                         who fails to comply with the
                                         national measures taken under this
                                         Directive;
(21) Whereas it is also necessary       (25) Whereas cross-border flows of
that the transfer of personal data       personal data are necessary to the
should be able to take place with        expansion of international trade;
third countries having an adequate       whereas the protection of
level of protection; whereas, in         individuals guaranteed in the
the absence of such protection in        Community by this Directive does
third countries, this Directive          not stand in the way of transfers
provides, in particular, for             of personal data to third countries
negotiation procedures with those        which ensure an adequate level of
countries;                               protection; whereas the adequacy of
                                         the level of protection afforded by
                                         a third country must be assessed in
                                         the light of all the circumstances
                                         surrounding the transfer operation
                                         or set of transfer operations;
 ---pagebreak--- - 57 -
     (26) Whereas, on the other hand,
     the transfer of personal data to a
     third country which does not ensure
     an adequate level of protection
     must be prohibited; whereas
     provision should be made for
     exemptions in certain circumstances
     where the data subject has given
     his consent or has been informed or
     where protection of the public
     interest so requires; whereas
     particular measures may be taken to
     rectify the lack of protection in a
     third country in cases where the
     person responsible for the
     processing offers appropriate
     assurances; whereas, moreover,
     provision must be made for
     procedures for negotiations between
     the Community and such third
     countries;
     (27) Whereas Member States may also
     provide for the use of codes of
     conduct drawn up by the business
     circles concerned and approved by
     the supervisory authority, with a
     view to adapting the national
     measures taken under this Directive
     to the specific characteristics of
     processing in certain sectors;
 ---pagebreak---                                       - 58 -
   19) Whereas the Member States must      (28) Whereas Member States must
   encourage the drawing-up, by the        encourage the business circles
   business circles concerned, of          concerned to draw up Community
   European codes of conduct or            codes of conduct so as to
   professional ethics relating to         facilitate the application of this
   certain specific sectors; whereas       Directive; whereas the Commission
   the Commission will support such        will support such initiatives and
   initiatives and will take them into     will take them into account when it
   account when it considers the            considers the appropriateness of
   appropriateness of new, specific         additional specific measures in
   measures in respect of certain           respect of certain sectors;
   sectors;
   (23) Whereas the existence in each      (29) Whereas the establishment in
   Member State of an independent           each Member State of an independent
   supervisory authority is an              supervisory authority is an
   essential component of the               essential component of the
   protection of individuals in             protection of individuals with
   relation to the processing of            regard to the processing of
   personal data; whereas, at               personal data; whereas such an
   Community level, a Working Party on      authority must have the necessary
   the Protection of Personal Data,         means to perform its duties,
   must be set up and be completely         including powers of investigation
   independent in the performance of        or intervention and powers in
   its functions; whereas having            connection with notification
   regard to its specific nature it         procedures; whereas such authority
   must advise the Commission and           must help to ensure transparency of
    contribute to the uniform                processing in the Member State
    application of the national rules       within whose jurisdiction it falls;
    adopted pursuant to this Directive;     whereas the authorities in the
                                            different Member States will need
                                             to assist one another in performing
                                             their duties;
01
 ---pagebreak---                                    - 59 -
                                        (30) Whereas, at Community level, a
                                        Working Party on the Protection of
                                        Individuals with regard to the
                                        Processing of Personal Data must be
                                        set up and be completely
                                        independent in the performance of
                                        its functions; whereas, having
                                        regard to its specific nature, it
                                        must advise the Commission and, in
                                        particular, contribute to the
                                        uniform application of the national
                                        rules adopted pursuant to this
                                        Directive;
(24) Whereas the adoption of            (31) Whereas the adoption of
additional measures for applying        additional measures for applying
the principles set forth in this        the principles set out in this
Directive calls for the conferment      Directive calls for the conferment
of rule-making powers on the            of rule-making powers on the
Commission and the establishment        Commission and the establishment of
aof an Advisory Committee in            an Advisory Committee in accordance
accordance with the procedures laid     with the procedures laid down in
down in Council Decision 87/373/EEC     Council Decision 87/373/EEC (4);
(4);
(8) Whereas the principles              (32) Whereas the principles set out
underlying the protection of            in this Directive regarding the
privacy in relation to the               protection of the rights and
processing of personal data set         freedoms of individuals, notably
forth in this Directive may be          their right to privacy, with regard
supplemented or clarified, in           to the processing of personal data
particular as far as certain            may be supplemented or clarified,
sectors are concerned, by specific      in particular as far as certain
rules based on those principles.        sectors are concerned, by specific
                                        rules based on those principles;
(4) OJ No L 197, 18.7.1937, p. 33.      (4) OJ No L 197, 18.7.1987, p. 33.
 ---pagebreak--- - 60 -
     (33) Whereas Member States should
      be allowed a period of not more
      than three years from the entry
      into force of the national measures
      transposing this Directive in which
      to apply such new national rules
      gradually to all processing
      operations already under way;
      (34) Whereas this Directive does
      not stand in the way of a Member
      State's regulating market research
      activities aimed at consumers
      residing in its territory in so far
      as such regulation does not concern
      the protection of individuals with
      regard to the processing of
       personal data,
 ---pagebreak---                                      - 61 -
               CHAPTER 1                                CHAPTER 1
           GENERAL PROVISIONS                      GENERAL PROVISIONS
               Article 1                                Article 1
        Object of the Directive                  Object of the Directive
1. The Member States shall ensure, in     1. In accordance with this Directive,
    accordance with this Directive,          Member States shall protect the
    the protection of the privacy of         rights and freedoms of natural
    individuals in relation to the           persons with respect to the
    processing of personal data              processing of personal data, and
    contained in data files.                 in particular their right of
                                             privacy.
2 . The Member States shall neither       2. Member States shall neither
    restrict nor prohibit the free           restrict nor prohibit the free
    flow of personal data between            flow of personal data between
    Member States for reasons to do          Member States for reasons
    with the protection afforded under       connected with the protection
    paragraph 1.                             afforded under paragraph 1.
 ---pagebreak---                                      - 62 -
              Article 2                                 Article 2
             Definitions                               Definitions
For the purposes of this Directive:       For the purposes of this Directive:
(a) "personal data" means any             (a) "personal data" means any
    information relating to an                information relating to an
    identified or identifiable                identified or identifiable
    individual ("data subject"); an           natural person ("data subject");
    identifiable individual is                an identifiable person is one who
    notably an individual who can be          can be identified, directly or
    identified by reference to an             indirectly, in particular by
    identification number or similar          reference to an identification
    identifying particular;                   number or to one or more factors
                                              specific to his physical,
                                              physiological, mental, economic,
                                              cultural or social identity;
                                              Data presented in statistical
                                              form, which is of such a type
                                              that the persons concerned can no
                                              longer be reasonably identified,
                                              are not considered as personal
                                              data.
 ---pagebreak---                                      - 63 -
(b) "depersonalize" means modify
    personal data in such a way that
    the information they contain can
    no longer be associated with a
    specific individual or an
    individual capable of being
    determined except at the price of
    an excessive effort in terms of
    staff, expenditure and time;
(d) "processing" means the following      (b) "processing of personal data"
    operations, whether or not                ("processing") means any
    performed by automated means: the         operation or set of operations
    recording, storage or combination         which is performed upon personal
    of data, and their alteration,            data, whether or not by automatic
    use or communication, including           means, such as collection,
    transmission, dissemination,              recording, organization, storage,
    retrieval, blocking and erasure;          adaptation or alteration,
                                              retrieval, consultation, use,
                                              disclosure by transmission,
                                              dissemination or otherwise making
                                              available, alignment or
                                              combination, blocking, erasure or
                                              destruction;
(c) "personal data file" (file) means     (c) "personal data file" ("file")
    any set of personal data, whether         means any structured set of
    centralized or geographically             personal data, whether
    dispersed, undergoing automatic           centralized or geographically
    processing or which, although not         dispersed, which is accessible
    undergoing automatic processing,          according to specific criteria
    are structured and accessible in          and whose object or effect is to
    an organized collection according         facilitate the use or alignment
    to specific criteria in such a            of data relating to the data
    way as to facilitate thair use or         subject or subjects;
    combination;
 ---pagebreak---                                  - 64 -
"controller of the file" means        (d) "controller" means any natural or
the natural or legal person,               legal person, public authority,
public authority, agency or other          agency or other body who
body competent under Community             processes personal data or causes
law or the national law of a               it to be processed and who
Member State to decide what will           decides what is the purpose and
be the purpose of the file, which          objective of the processing,
categories of personal data will           which personal data are to be
be stored, which operations will           processed, which operations are
be applied to them and which               to be performed upon them and
third parties may have access to           which third parties are to have
them;                                      access to them;
                                       (e) "processor" means any natural or
                                           legal person who processes
                                           personal data on behalf of the
                                           controller;
                                       (f) "third party" means any natural
                                           or legal person other than the
                                           data subject, the controller and
                                           any person authorized to process
                                           the data under the controller's
                                           direct authority or on his
                                            behalf ;
 ---pagebreak---                                      - 65 -
                                          (g) "the data subject's consent"
                                              means any express indication of
              Article 12                      his wishes by which the data
           Informed consent                   subject signifies his agreement
                                              to personal data relating to him
Any giving of consent by a data               being processed, on condition he
subject to the processing of personal         has available information about
data relating to him within the               the purposes of the processing,
meaning of this Directive shall be            the data or categories of data
valid only if:                                concerned, the recipient of the
                                              personal data, and the name and
(a) the data subject is supplied with         address of the controller and of
    the following information:                his representative if any;
    - the purposes of the file and            The data subject's consent must
      the types of data stored;               be freely given and specific, and
                                              may be withdrawn by the data
    - the type of use and, where              subject at any time, but without
      appropriate, the recipients of          retrospective effect.
      the personal data contained in
      the file;
    - the name and address of the
      controller of the file;
(b) it is specific and express and
    specifies the types of data,
    forms of processing and potential
    recipients covered by it;
(c) it may be withdrawn by the data
    subject at any time without
    retroactive effect;
 ---pagebreak---                                      - 66 -
(f) "supervisory authority" means the
    independant public authority or
    other independent body designated
    by each Member State in
    accordance with Article 26 of
    this Directive;
(g) "public sector" means all the
    authorities, organizations and
    entities of a Member state that
    are governed by public law, with
    the exception of those which
    carry on an industrial or
    commercial activity, and bodies
    and entities governed by private
    law where they take part in the
    exercise of official authority;
(h) "private sector" means any
     natural or legal person or
     association, including public
     sector authorities, organizations
     and entities in so far as they
     carry on an industrial or
     commercial activity.
 ---pagebreak---                                      - 67 -
              Article 3                                 Article 3
                Scope                                     Scope
1. The Member States shall apply this     1. This Directive shall apply to the
   Directive to files in the public          processing of personal data wholly
   and private sectors with the              or partly by automatic means, and
   exception of files in the public          to the processing otherwise than
   sector wherre the activities of           by automatic means of personal
   that sector do not fall within the        data which forms part of a file or
   scope of Community law.                   is intended to form part of a
                                             file.
2. This Directive shall not apply to      2. This Directive shall not apply:
   files held by:
                                             to the processing of data in the
(a) an individual solely for private         course of an activity which falls
    and personal purposes; or                outside the scope of Community
                                             law;
(b) non-profit-making bodies, notably
    of a political, philosophical,        -  to the processing of personal data
    religious, cultural, trade union,        by a natural person in the course
    sporting or leisure nature, as           of a purely private and personal
    part of their legitimate aims, on        activity.
    condition that they relate only
    to those members and
    corresponding members who have
    consented to being included
    therein and that they are not
    communicated to third parties.
 ---pagebreak---                                      - 68 -
              Article 4                                  Article 4
           Law applicable                         National law applicable
1. Each Member State shall apply this      1. Each Member State shall apply the
   Directive to:                              national provisions adopted under
                                              this Directive to all processing
                                              of personal data:
(a) all files located in its
    territory;
(b) the controller of a file resident     (a) of which the controller is
    in its territory who uses from             established in its territory or
    its territory a file located in a          is within its jurisdiction;
    third country whose law does not
    provide an adequate level of
    protection, unless such use is
    only sporadic.
                                          (b) of which the controller is not
                                               established in the territory of
                                               the Community, where for the
                                               purpose of processing personal
                                               data he makes use of means,
                                               whether or not automatic, which
                                               are located in the territory of
                                               that Member State.
 ---pagebreak---                                   - 69 -
Each Member State shall apply          2. In the circumstances referred to
Articles 5, 6, 8, 9, 10, 17, 18            in paragraph 1(b) the controller
and 21 of this Directive to a user         must designate a representative
consulting a file located in a             established in the territory of
third country from a terminal              that Member state, who shall be
located in the territory of a              subrogated to the controller's
Member State, unless such use is           rights and obligations.
only sporadic.
Where a file is moved temporarily
from one Member State to another,
the latter shall place no obstacle
in the way and shall not require
the completion of any formalities
over and above those applicable in
the Member state in which the file
is normally located.
                                                      CHAPTER II
                                         GENERAL RULES ON THE LAWFULNESS OF
                                           THE PROCESSING OF PERSONAL DATA
                                                       Article 5
                                        Member States shall provide that the
                                       processing of personal data is lawful
                                       only if carried out in accordance
                                       with this Chapter.
                                       Subject to this Chapter,
                                        Member States may more precisely
                                        determine the circumstances in which
                                       the processing of personal data is
                                       lawful.
 ---pagebreak---                                     - 70 -
               CHAPTER V                                SECTION I
             DATA QUALITY                  PRINCIPLES RELATING TO DATA QUALITY
               Article 16                               Article 6
               Principles
1. The Member States shall provide        1. Member States shall provide that
   that personal data shall be:              personal data must be:
(a) collected and processed fairly       (a) processed fairly and lawfully;
    and lawfully;
(b) stored for specified, explicit       (b) collected for specified, explicit
    and lawful purposes and used in a         and legitimate purposes and used
    way compatible with those                 in a way compatible with those
    purposes ;                                purposes;
(c) adequate, relevant and not            (c) adequate, relevant and not
    excessive in relation to the              excessive in relation to the
    purposes for which they are               purposes for which they are
    stored;                                   processed;
(d) accurate and, if necessary, kept      (d) accurate and, where necessary,
    up to date; inaccurate or                 kept up to date;  every step must
    incomplete data shall be erased           be taken to ensure that data
    or rectified;                             which are inaccurate or
                                              incomplete having regard to the
                                              purposes for which they were
                                              collected are erased or
                                              rectified;
 ---pagebreak---                                      - 71 -
(e) kept in a form which permits          (e) kept in a form which permits
    identification of the data                identification of data subjects
    subjects for no longer than is            for no longer than is necessary
    necessary for the purpose for             for the purposes in view;
    which the data are stored.                Member States may lay down
                                              appropriate safeguards for
                                              personal data stored for
                                              historical, statistical or
                                              scientific use.
2. It shall be for the controller of      2. It shall be for the controller to
   the file to ensure that                   ensure that paragraph 1 is
   paragraph 1 is complied with.             complied with.
              CHAPTER II                                SECTION II
   LAWFULNESS OF PROCESSING IN THE              PRINCIPLES RELATING TO THE
            PUBLIC SECTOR                      GROUNDS FOR PROCESSING DATA
              Article 5                                 Article 7
             Principles
1. Subject to Article 6, the Member       Member states shall provide that
   States shall, with respect to          personal data may be processed only
   files in the public sector,            if:
   provide in their law that:
 ---pagebreak---                                  - 72 -
the creation of a file and any        (a) the data subject has consented;
other processing of personal data
shall be lawful in so far as they
are necessary for the performance     (b) processing is necessary for the
of the tasks of the public                performance of a contract with
authority in control of the file;         the data subject, or in order to
                                          take steps at the request of the
                                          data subject preliminary to
                                          entering into a contract;
the processing of data for a          (c) processing is necessary in order
purpose other than that for which         to comply with an obligation
the file was created shall be             imposed by national law or by
lawful if:                                Community law;
- the data subject consents           (d) processing is necessary in order
  thereto, or                             to protect the vital interests of
                                          the data subject;
- it is effected on the basis of
  Community law, or of a law, or      (e) processing is necessary for the
  a measure taken pursuant to a           performance of a task in the
  law, of a Member State                  public interest or carried out in
  conforming with this Directive          the exercise of public authority
  which authorizes it and defines         vested in the controller or in a
  the limites thereto, or                 third party to whom the data are
                                          disclosed; or
- the legitimate interests of the
  data subject do not preclude        (f) processing is necessary in
  such change of purpose, or              pursuit of the general interest
                                          or of the legitimate interests of
- it is necessary in order to             the controller or of a third
  ward off an imminent threat to          party to whom the data are
  public order or a serious               disclosed, except where such
  infringement of the rights of           interests are overridden by the
  others.                                 interests of the data subject.
 ---pagebreak---                                      - 73 -
               Article 6
   Processing in the public sector
       having as its object the
    communication of personal data
1. The Member States shall provide in
   their law that the communication
   of personal data contained in the
   files of a public sector entity
   shall be lawful only if:
(a) it is necessary for the
    performance of the tasks of the
    public sector entity
    communicating or requesting
    communication of the data; or
(b) it is requested by a natural or
    legal person in the private
    sector who invokes a legitimate
    interest, on condition that the
    interest of the data subject does
    not prevail.
 ---pagebreak---                                      - 74 -
2. Without prejudice to paragraph 1,
   the Member States may specifiy the
   conditions under which the
   communication of personal data is
   lawful.
3. The Member States shall provide in
   their law that, in the
   circumstances referred to in
   paragraph 1 (b), the controller of
   the file shall inform data
   subjects of the communication of
   personal data. The Member States
   may provide for the replacing of
   such provision of information by
   prior authorization by the
   supervisory authority.
 ---pagebreak---                                      - 75 -
              CHAPTER III
   LAWFULNESS OF PROCESSING IN THE
            PRIVATE SECTOR
               Article 8
              Principles
1. The Member States shall provide in
   their law that, without the
   consent of the data subject, the
   recording in a file and any other
   processing of personal data shall
   be lawful only if it is effected
   in accordance with this Directive
   and if:
(a) the processing is carried out
    under a contract, or in the
    context of a quasi-contractual
    relationship of trust, with the
    data subject and is necessary for
    its discharge; or
(b) the data come from sources
    generally accessible to the
    public and their processing is
    intended solely for
    correspondence purposes; or
 ---pagebreak---                                      - 76 -
(c) the controller of the file is
    pursuing a legitimate interest,
    on condition that the interest of
    the data subject does not
    prevail.
2. The Member States shall provide in
   their law that it shall be for the
   controller of the file to ensure
   that no communication is
   incompatible with the purpose of
   the file or is contrary to public
   policy. In the event of on-line
   consultation, the same obligations
   shall be incumbent on the user.
3. Without prejudice to paragraph 1,
   the Member States may specify the
   conditions under which the
   processing of personal data is
   lawful.
 ---pagebreak---                                      - 77 -
              CHAPTER V                                SECTION III
             DATA QUALITY                   SPECIAL CATEGORIES OF PROCESSING
              Article 17                                Article 8
      Special categories of data                The processing of special
                                                    categories of data
1. The Member States shall prohibit       1. Member States shall prohibit the
   the automatic processing of data          processing of data revealing
   revealing ethnic or racial origin,        racial or ethnic origin, political
   political opinions, religious or          opinions, religious beliefs,
   philosophical beliefs or trade            philosophical or ethical
   union membership, and of data             persuasion or trade-union
   concerning health or sexual life,         membership, and of data concerning
   without the express and written           health or sexual life.
   consent, freely given, of the data
   subject.
                                          2. Member States shall provide that
                                             data referred to in paragraph 1
                                             may be processed where:
 ---pagebreak--- -Te­
    ia.) the data subject has given his
         written consent to the processing
         of that data, except where the
         laws of the Member State provide
         that the prohibition referred to
         in paragraph 1 may not be waived
         by the data subject giving his
         consent;
    (b) processing is carried out by a
         foundation or non-profit-making
         association of a political,
         philosophical, religious or trade
         union character in the course of
         its legitimate activities and on
         condition that the processing
         relates solely to members of the
         foundation or association and to
         persons who have regular contact
         with it in connection with its
         purposes and that the data are
         not disclosed to third parties
         without the data subject's
         consent; or
    (c) the processing is performed in
         circumstances where there is
         manifestly no infringement of
         privacy or fundamental freedoms.
    The processing of data referred to at
    point (b) shall not be subject to the
    obligation to notify imposed in
    Section VIII of this Chapter.
 ---pagebreak---                                   - 79 -
The Member States may, on              3. Member States may, on grounds of
important public interest grounds,        important public interest, lay
grant derogations from paragraph 1        down exemptions from paragraph 1
on the basis of a law specifying          by national legislative provision
the types of data which may be            or by decision of the supervisory
stored and the persons who may            authority, stating the types of
have access to the file and               data which may be processed, the
providing suitable safeguards             persons to whom such data may be
against abuse and unauthorized            disclosed and the persons who may
access.                                   be controllers, and specifying
                                          suitable safeguards.
Data concerning criminal               4. Data concerning criminal
convictions shall be held only in         convictions may be held only by
public sector files.                      judicial and law-enforcement
                                          authorities and by the persons
                                          directly concerned with those
                                          convictions or by their
                                          representatives;  Member States
                                          may, however,  lay down exemptions
                                          by means of a legislative
                                          provision which shall specify
                                          suitable safeguards.
                                       5. Member States shall determine the
                                          conditions under which a national
                                          identification number or other
                                          identifier of general application
                                          may be used.
 ---pagebreak---                                     - 80 -
             CHAPTER VI
  PROVISIONS SPECIFICALLY RELATING
         TO CERTAIN SECTORS
              Article 19                                Article 9
                                               Processing of personal data
                                                and freedom of expression
The Member States may grant, in           With a view to reconciling the right
respect of the press and the              to privacy with the rules governing
audiovisual media, derogations from       freedom of expression, Member States
the provisions of this Directive in       shall prescribe exemptions from this
so far as they are necessary to           Directive in respect of the
reconcile the right to privacy with       processing of personal data solely
the rules governing freedom of            for journalistic purposes by the
information and of the press.             press, the audio-visual media and
                                          journalists.
 ---pagebreak---                                      - 81 -
              CHAPTER IV                                SECTION IV
       RIGHTS OF DATA SUBJECTS                    INFORMATION TO BE GIVEN
                                                    TO THE DATA SUBJECT
              Article 14                                 Article 10
  Additional rights of data subjects           The existence of a processing
                                                          operation
The Member States shall grant a data       1. Member States shall ensure that
subject the following rights:                 any person is entitled, on
                                              request, to know of the existence
3. To know of the existence of a file         of a processing operation, its
   and to know its main purposes and          purposes, the categories of data
   the identity and habitual                  concerned, any third parties or
   residence, headquarters or place           categories of third party to whom
   of business of the controller of           the data are to be disclosed, and
   the file.                                  the name and address of the
                                              controller and of his
                                              representative, if any.
                                          2. Member States may lay down
                                              exemptions from paragraph 1 in the
                                              circumstances referred to in
                                              Article 14(1).
 ---pagebreak---                                      - 82 -
              Article 13                                 Article 11
     Provision of information at                  Collection of data from
       the time of collection                         the data subject
1. The Member States shall guarantee       1. Member States shall provide that
   individuals from whom personal             the controller must ensure that a
   data are collected the right to be         data subject from whom data are
   informed at least about:                   collected be informed at least of
                                              the following:
(a) the purposes of the file for          (a) the purposes of the processing
    which the information is                   for which the data are intended;
    intended;
(b) the obligatory or voluntary            (b) the obligatory or voluntary
    nature of their reply to the               nature of any reply to the
    questions to which answers are             questions to which answers are
    sought ;                                   sought;
(c) the consequences if they fail to       (c) the consequences for him if he
    reply ;                                    fails to reply;
(d) the recipients of the                  (d) the recipients or categories of
    information;                               recipients of the data;
(e) the existence of the right of          (e) the existence of a right of
    access to and rectification of             access to and rectification of
    the data relating to them; and             the data relating to him;   and
 ---pagebreak---                                      - 83 -
(f) the name and address of the           (f) the name and address of the
    controller of the file.                   controller and of his
                                              representative if any.
2. Paragraph 1 shall not apply to the     2. Paragraph 1 shall not apply to the
   collection of information where to        collection of data where to inform
   inform the data subject would             the data subject would hinder or
   prevent the exercise of the               prevent the exercise of or the co­
   supervision and verification              operation with the supervision and
   functions of a public order.              verification functions of a public
                                             authority or the maintenance of
                                             public order.
             CHAPTER III
       LAWFULNESS OF PROCESSING
        IN THE PRIVATE SECTOR
              Article 9                                 Article 12
Obligation to inform the data subject          Disclosure to a third party
1. The Member States shall, with          1. Member States shall provide that
   respect to the private sector,            in the cases referred to in
   provide in their law that at the          Article 7(b), (c), (e) and (f) the
   time of first communication or of         controller must satisfy himself
   the affording of an opportunity           that at the appropriate time, and
   for on-line consultation the              no later than the time when the
   controller of the file shall              data are first disclosed to a
   inform the data subject                   third party, the data subject is
   accordingly, indicating also the          informed of this disclosure and of
   purpose of the file, the types of         the following information at
   data stored therein and his name          least:
   and address.
 ---pagebreak---                                      - 84 -
                                             (a)  the name and address of the
                                                  controller and of his
                                                  representative, if any;
                                             (b)  the purposes of the
                                                  processing;
                                             (c)  the categories of data
                                                  concerned;
                                             (d)  the recipients or categories
                                                  of recipients; and
                                             (e)  the existence of rights of
                                                  access, rectification and
                                                  objection.
2. The provision of information under     2. Paragraph 1 shall not apply where:
   paragraph 1 shall not be mandatory        the data subject has already been
   in the circumstances referred to          informed that the data are to be
   in Article 8 (1) (b). There shall         or may be disclosed to a third
   be no olbigation to inform where          party;
   communication is required by law.      -  disclosure to a third party is
                                             required by a legal provision
3. If the data subject objects to            which lays down an exemption from
   communication or any other                the obligation to inform; or
   processing, the controller of the         the data are disclosed to a third
   file shall cease the processing           party for one of the reasons
   objected to unless he is                  listed in Article 14(1).
   authorized by law to carry it out.
 ---pagebreak---                                      - 85 -
                                          3. Where the provision of information
                                              to the data subject proves
              Article 10                      impossible or involves a
       Special exception to the               disproportionate effort, or runs
obligation to inform the data subject         counter to the overriding
                                              legitimate interests of the
If the provision of information to            controller or similar interests of
the data subject provided for in              a third party, Member States may
Article 9 (1) proves impossible or            empower the supervisory authority
involves a disproportionate effort,           to authorize an exemption, laying
or comes up against the overriding            down any suitable safeguards.
legitimate interests of the
controller of the file or a similar
intrest of a third party, the Member
States may provide in their law that
the supervisory authority may
authorize a derogation.
              CHAPTER IV                                 SECTION V
       RIGHTS OF DATA SUBJECTS                  THE DATA SUBJECT'S RIGHT OF
                                                       ACCESS TO DATA
              Article 14                                 Article 13
  Additional rights of data subjects                  Right of access
The Member States shall grant a data       Member States shall grant all data
subject the following rights:             subjects the following rights:
 ---pagebreak---                                      - 86 -
4. To obtain at reasonable intervals      1. to obtain, on request, at
   and without excessive delay or             reasonable intervals and without
   expense confirmation of whether            excessive delay or expense,
   personal data relating to him are          confirmation of the existence of
   stored in a file and communication         personal data relating to him,
   to him of such data in an                  communication to him of such data
   intelligible form.                         in an intelligible form, an
                                              indication of their source, and
                                              general information on their use.
   The Member States may provide that         Member States may provide that the
   the right of access to medical             right of access to medical data
   data may be exercised only through         may be exercised only through a
   a doctor.                                  medical practitioner;
                                          2. to refuse any demand by a third
                                              party that he should exercise his
                                              right of access in order to
                                              communicate the data in question
                                              to that third party or to another
                                              party, unless the third party's
                                              request is founded on national or
                                              Community law;
5. To obtain, as the case may be,          3. to obtain, as the case may be, the
   rectification, erasure or blocking         rectification of inaccurate or
   of such data if they have been             incomplete data or the erasure or
   processed in violation of the              blocking of such data if they have
   provisions of this Directive.              been processed in breach of this
                                              Directive;
 ---pagebreak---                                      - 87 -
7. To obtain, in the event of the         4. where point 3 applies, to be
   application of paragraph 5 and if          notified of the rectification,
   the data have been communicated to         erasure or blocking to any third
   third parties, notification to the         party to whom the data have been
   latter of the rectification,               disclosed;
   erasure or blocking.
                                          5. to be informed of the reasoning
                                              applied in any automatic
                                              processing operations the outcome
                                              of which is invoked against him.
             Article 15                                  Article 14
  Exceptions to the data subject's           Exceptions to the right of access
         right of access to
         public sector files
1. The Member States may limit by          1. Unless obliged to do so by a
   statute the rights provided for in         provision of Community law,
   points 3 and 4 of Article 14 for           Member States may restrict the
   reasons relating to:                       exercise of the rights provided
                                              for in Article 10(1) and in point
                                              1 of Article 13 where such
                                              restriction is necessary to
                                              safeguard:
(a) national security;                    (a) national security;
(b) defence;                              (b) defence;
(c) criminal proceedings;                 (c) criminal proceedings;
 ---pagebreak---                                     - 88 -
(d) public safety;                       (d) public safety;
(e) a duly established paramount         (e) a duly established paramount
    economic and financial interest          economic and financial interest
    of a Member State or of the              of a Member State or of the
    European Communities;                    Community;
(f) the need for the public              (f) a monitoring or inspection
    authorities to perform monitoring        function performed by a public
    or inspection functions; or              authority or an activity
                                             undertaken to assist the
                                             performance of such a function;
(g) an equivalent right of another       (g) an equivalent right of another
    individual and the rights and            person and the rights and
    freedoms of others.                      freedoms of others.
2. In the circumstances referred to      2. In the circumstances described in
   in paragraph 1, the supervisory          paragraph 1, the supervisory
   authority shall be empowered to          authority shall be empowered to
   carry out, at the request of the         carry out the necessary checks, at
   data subject, the necessary checks       the data subject's request, so as
   on the file.                             to verify the lawfulness of the
                                            processing within the meaning of
                                            this Directive, respecting the
                                            interests to be protected in
                                            accordance with paragraph 1.
 ---pagebreak---                                         - 89 -
3. The Member States may place limits         3. Member States may limit the right
     on the data subject's right of              of access of the person concerned
     access to data compiled                     to data temporarily kept in
     temporarily for the purpose of              personal form and which is
     extracting statistical information          intended to serve statistical ends
     therefrom.                                  of such a type that the persons
                                                 concerned can no longer be
                                                 reasonably identified.
                                                            SECTION VI
                                               THE DATA SUBJECT'S RIGHT TO OBJECT
                 Article 14                                 Article 15
   Additional rights of data subjects            Objection on legitimate grounds
The Member States shall grant a data          1. Member States shall grant the data
subject the following rights:                    subject the right to object at any
                                                 time on legitimate grounds   to the
1. To oppose, for legitimate reasons,            processing of data relating to
    the processing of personal data              him.
    relating to him.
6 . To obtai LÎ upon request and free of     2. Where there is a justified
    charge the erasure of data                   objection,   the controller shall
    relating to him held in files used           cease the processing.
    for market research or advertising
    purposes.
 ---pagebreak---                                      - 90 -
                                          3. The controller must ensure that
                                              the opportunity to have data
                                              erased without cost has been
                                              expressly offered to a data
                                              subject before personal data are
                                              disclosed to third parties or used
                                              on their behalf for the purposes
                                              of marketing by mail.
                                                         Article 16
                                               Automated individual decisions
2. Not to be subject to an                 1. Member States shall grant the
   administrative or private decision         right to every person not to be
   involving an assessment of his             subjected to an administrative or
   conduct which has as its sole              private decision adversely
   basis the automatic processing of          affecting him which is based
   personal data defining his profile         solely on automatic processing
   or personality.                            defining a personality profile.
                                           2. Subject to the other Articles of
                                              this Directive, Member States
                                              shall provide that a person may be
                                              subjected to a decision of the
                                              kind referred to in paragraph 1 if
                                              that decision:
 ---pagebreak---                                      - 91 -
                                          (a) is taken in the course of the
                                               entering into or performance of a
                                               contract, provided any request by
                                               the data subject has been
                                               satisfied, or that there are
                                               suitable measures to safeguard
                                               his legitimate interests, which
                                               must include arrangements
                                               allowing him to defend his point
                                               of view; or
                                          (b) is authorized by law which also
                                               lays down measures to safeguard
                                               the data subject's legitimate
                                               interests.
              CHAPTER V                                 SECTION VII
            DATA QUALITY                           SECURITY OF PROCESSING
              Article 18                                 Article 17
            Data security
1. The Member States shall provide in      1. Member States shall provide that
   their law that the controller of a         the controller must take
   file shall take appropriate                appropriate technical and
   technical and organizational               organizational measures to protect
   measures to protect personal data          personal data against accidental
   stored in the file against                 or unlawful destruction or
   acidental or unauthorized                  accidental loss and against
   destruction or accidental loss and         unauthorized alteration or
   against unauthorized access,               disclosure or any other
   modification or other processing.          unauthorized form of processing.
 ---pagebreak---                                   - 92 -
Such measures shall ensure, in            Such measures shall ensure, in
respect of automated files, an            respect of the automatic
appropriate level of security              processing of data, a suitable
having regard to the state of the          level of security having regard to
art in this field, the cost of             the state of the art and  the
taking the measures, the nature of         nature of the data to be
the data to be protected and the           protected, and an evaluation of
assessment of the potential risks.         the potential risks involved. To
To that end, the controller of the         that end, the controller shall
file shall take into consideration         take into consideration any
any recommendations on data                recommendations on data security
security and network                       and network interoperability made
interoperability formulated by the         by the Commission in accordance
Commission in accordance with the          with the procedure referred to  in
procedure provided for in                  Article 33.
Article 29.
Methods guaranteeing adequate           2. Methods ensuring an appropriate
security shall be chosen for the           level of security shall be chosen
transmission of personal data in a         for the transmission of personal
network.                                   data within a network.
In the event of on-line                 3. Where an opportunity is provided
consultation, the hardware and             for remote access, the controller
software shall be designed in such         shall utilize the hardware and
 a way that the consultation tkaes         software in such a way that the
 place within the limits of the            access takes place within the
 authorization granted by the              limits of the lawfulness of the
controller of the file.                    processing.
 ---pagebreak---                                      - 93 -
4. The obligations referred to in         4. The obligations referred to in
   paragraphs 1, 2, and 3 shall also         paragraphs 1, 2 and 3 shall also
   be incumbent on persons who,              be incumbent on persons who share
   either de facto or by contract,           responsibility for carrying out
   control the operations relating to        the processing, and, in
   a file.                                   particular, on the processor.
5. Any person who in the course of        5. Any person who, in the course of
   his work has access to information        his work, has access to personal
   contained in files shall not              data shall not disclose it to
   communicate it to third parties           third parties without the
   without the agreement of the              controller's agreement, unless he
   controller of the file.                   is required to do so under
                                             national or Community law.
 ---pagebreak---                                     - 94 -
             CHAPTER II                                SECTION VIII
      LAWFULNESS OF PROCESSING                         NOTIFICATION
        IN THE PUBLIC SECTOR
              Article 7                                 Article 18
      Obligation to notify the                   Obligation to notify the
        supervisory authority                     supervisory authority
1. The Member States shall provide in     1. Member States shall provide that
   their law that the creation of a          the controller or his
   public sector file, the personal          representative, if any, must
   data in which might be                    notify the supervisory authority
   communicated, shall be notified in        referred to in Article 30 before
   advance to the supervisory                carrying out any wholly or partly
   authority and recorded in a               automatic processing or a set of
   register kept by that authority.          processing operations of the same
   The register shall be freely              type intended to serve a single
   available for consultation.               purpose or several related
                                             purposes.
 ---pagebreak---                                      - 95 -
2. The Member States shall specify        2. Member States shall specify the
   the information which must be             information to be given in the
   notified to the supervisory               notification.  It shall include at
   authority. That information shall         least:
   include at least the name and
   address of the controller of the       (a) the name and address of the
   file, the purpose of the file, a           controller and of his
   description of the types of data           representative, if any;
   it contains, the third parties to      (b) the purpose or purposes of the
   whom the data might be                     processing;
   communicated and a description of      (c) the category or categories of
   the measures taken pursuant to             data subject;
   Article 18.                            (d) a description of the data or of
                                              the categories of data to which
3. The Member States may provide that         the processing relates;
   paragraphs 1 and 2 shall apply to      (e) the third parties or categories
   other public sector files and that         of third party to whom the data
   consultation of the register may           might be disclosed;
   be restricted for the reasons          (f) proposed transfers of data to
   stated in Article 15 (1).                  third countries;
                                          (g) a description of the measures
                                              taken pursuant to Article 17 to
                                              ensure security of processing.
 ---pagebreak---                                      - 96 -
                                           3. Any change affecting the
             CHAPTER III                      information referred to in
                                              paragraph 2 must be notified to
      LAWFULNESS OF PROCESSING                the supervisory authority.
        IN THE PRIVATE SECTOR
                                           4. Before processing which poses
              Article 11                      specific risks to the rights and
      Obligation to notify the                freedoms of individuals commences,
        supervisory authority                 the supervisory authority shall
                                              examine such processing within a
1. The Member States shall provide in         period of 15 days commencing with
   their law that the controller of           the date of the notification at
   the file shall notify the creation         the end of which period the
   of a personal data file where the          authority shall give its
   data are intended to be                    conclusions.
   communicated and do not come from
   sources generally accessible to         5. Member States may provide that
   the public. The notification shall         some of the processing operations
   be made to the supervisory                 referred to in paragraph 4 shall
   authority of the Member State in           be authorized beforehand either by
   which the file is located or, if           law or by decision of the
   it is not located in a Member              supervisory authority.
   State, to the supervisory
   authority of the Member State in
   which the controller of the file
   resides. The controller of the
   file shall notify to the competent
   national authorities any change in
   the purpose of the file or any
   change in his address.
 ---pagebreak---                                      - 97 -
2. The Member States shall specify
   the information which must be
   notified to the supervisory
   authority. That information shall
   include at least the name and
   address of the controller of the
   file, the purpose of the file, a
   description of the types of data
   it contains, the third parties to
   whom the data might be
   communicated and a description of
   the measures taken pursuant to
   Article 18.
3. The Member States may provide that
   paragraphs 1 and 2 shall apply to
   other private sector files and
   that the information referred to
   in paragraph 2 shall be accessible
   to the public.
 ---pagebreak---            Article 19
Simplification of and exemption
  from the obligation to notify
Member States shall provide for
the taking of measures to simplify
or exempt from the obligation to
notify in the case of certain
categories of processing operation
which do not adversely affect the
rights and freedoms of data
subjects. Such categories of
processing include the production
of correspondence or papers, the
satisfaction of legal, accounting,
tax or social security duties or
the consultation of documentation
services accessible to the public.
Simplification or exemption
measures shall be adopted either
by or after consulting the
supervisory authority. Such
 measures shall particularly
 specify, for each category of
 processing operation:
 ---pagebreak--- - 99 -
         - the purposes of the processing;
         - a description of the data or
           categories of data undergoing
           processing;
         - the category or categories of
           data subject;
         - the third parties or categories
           of third party to whom the data
           are to be disclosed;
         - the length of time the data are
           to be stored;
         - where appropriate, the
           conditions under which the
           processing is to be carried out.
      3. Simplification or exemption from
         the obligation to notify shall not
         release the controller from any of
         the other obligations resulting
         from this Directive.
                    Article 20
           Manual processing operations
      Member States may lay down the
      conditions under which Articles 18
      and 19 are to apply to non-automatic
      processing operations involving
      personal data contained in files.
 ---pagebreak---                                    - 100 -
                                                       Article 21
                                                  Register of notified
                                                  processing operations
                                         Member States shall provide that a
                                         register of notified processing
                                         operations must be maintained by the
                                         supervisory authority. The register
                                         shall as a minimum in the cases
                                         provided for in Articles 18 and 19,
                                         contain the information listed in
                                         Article 18(2)(a) to (f).   It may be
                                         inspected by any person subject to
                                         such restrictions as may be imposed
                                         by Member States on the same grounds
                                          as are set out in Article 14(1).
             CHAPTER VI
  PROVISIONS SPECIFICALLY RELATING
         TO CERTAIN SECTORS
             Article 20
The Member States shall encourage the
business circles concerned to
participate in drawing up European
codes of conduct or professional
ethics in respect of certain sectors
on the basis of the principles set
forth in this Directive.
 ---pagebreak---                                      - 101 -
                                                        CHAPTER III
              CHAPTER IV
                                                JUDICIAL REMEDIES, LIABILITY
        RIGHTS OF DATA SUBJECTS                        AND PENALTIES
              Article 14                                 Article 22
  Additional rights of data subjects                 Judicial remedies
The Member States shall grant a data       Member States shall provide for the
subject the following rights:              right of every person to a judicial
                                           remedy for any breach of the rights
8. To have a judicial remedy if the        guaranteed by this Directive.
   rights guaranteed in this Article
   are infringed.
 ---pagebreak---                                     - 102 -
             CHAPTER VII
       LIABILITY AND SANCTIONS
              Article 21                                Article 23
              Liability                                 Liability
1. The Member States shall provide in     1. Member States shall provide that
   their law that any individual             any person whose personal data are
   whose personal data have been             undergoing processing and who
   stored in a file and who suffers          suffers damage as a result of an
   damage as a result of processing          unlawful processing operation or
   or of any act incompatible with           of any act incompatible with the
   this Directive shall be entitled          national provisions adopted
   to compensation from the                  pursuant to this Directive is
   controller of the file.                   entitled to receive compensation
                                             from the controller for the damage
                                             suffered.
2. The Member States may provide that     2. Member States may provide that the
   the controller of the file shall          controller may be exempted, in
   not be liable for any damage              whole or in part, from his
   resulting from the loss or                liability for damage resulting
   destruction of data or from               from the loss or destruction of
   unauthorized access if he proves          data or from unauthorized access
   that he has taken appropriate             if he proves that he has taken
   measures to fulfil the                    suitable steps to satisfy the
   requirements of Articles 18 and           requirements of Articles 17 and
   22.                                       24.
 ---pagebreak---                                   - 103 -
           Article 22                                 Article 24
  Processing on behalf of the                    Processing on behalf
     controller of the file                       of the controller
The Member States shall provide in      1. Member States shall provide that
their law that the controller of           the controller must, where
the file must, where processing is         processing is carried out on his
carried out on his behalf, ensure          behalf, ensure that the necessary
that the necessary security and            security and organizational
organizational measures are taken          measures are taken and choose a
and choose a person or enterprise          processor who provides sufficient
who provides sufficient guarantees         guarantees in that respect.
in that respect.
Any person who collects or              2. The processor shall carry out only
processes personal data on behalf          such processing of personal data
of the controller of the file              as is stipulated in his contract
shall fulfil the obligations               with the controller and shall take
provided for in Article 16 and 18          instructions only from the latter.
of this Directive.                         He shall comply with the national
                                           provisions adopted pursuant to
                                           this Directive.
The contract shall be in writing        3. The contract shall be in writing
and shall stipulate, in                    and shall state, in particular,
particular, that the personal data         that personal data processed
may be divulged by the person              thereunder may be disclosed to a
providing the service or his               third party by the processor or
employees only with the agreement          his employees only with the
of the controller of the file.             controller's agreement.
 ---pagebreak---                                     - 104 -
              Article 23                                Article 25
              Sanctions                                 Penalties
Each Member State shall make              Each Member State shall provide for
provision in its law for the              the imposition of dissuasive
application of dissuasive sanctions       penalties on any person who does not
in order to ensure compliance with        comply with the national provisions
the measures taken pursuant to this       adopted pursuant to this Directive.
Directive.
             CHAPTER VIII                               CHAPTER IV
      TRANSFER OF PERSONAL DATA                 TRANSFER OF PERSONAL DATA
          TO THIRD COUNTRIES                        TO THIRD COUNTRIES
              Article 24                                Article 26
              Principles                                Principles
1. The Member States shall provide in     1. Member States shall provide that
   their law that the transfer to a          the transfer, whether temporary or
   third country, whether temporary          permanent, to a third country of
   or permanent, of personal data            personal data which are undergoing
   which are undergoing processing or        processing or which have been
   which have been gathered with a           collected with a view to
   view to processing may take place         processing may take place only if
   only if that country ensures an           the third country in question
   adequate level of protection.             ensures an adequate level of
                                             protection.
 ---pagebreak--- Notwithstanding the first
subparagraph. Member States shall
provide that a transfer to a third
country which does not ensure an
adequate level of protection may
take place on condition that:
- subject, where appropriate, to
  Article 8(2)(a), the data
  subject has consented to the
  proposed transfer in order to
  take steps preliminary to
  entering into a contract;
- the transfer is necessary for
  the performance of a contract
  between the data subject and the
  controller, on condition that
  the data subject has been
  informed of the fact that it is
  or might be proposed to transfer
  the data to a third country
  which does not ensure an
  adequate level of protection;
- the transfer is necessary on
  important public interest
  grounds; or
- the transfer is necessary in
  order to protect the vital
  interests of the data subject.
 ---pagebreak---                                     - 106 -
                                          2. The adequacy of the level of
                                             protection afforded by a third
                                             country shall be assessed in the
                                             light of all the circumstances
                                             surrounding a data transfer
                                             operation or set of data transfer
                                             operations; particular account
                                             shall be taken of the nature of
                                             the data, the purpose or purposes
                                             and duration of the proposed
                                             processing operation or
                                             operations, the legislative
                                             provisions, both general and
                                             sectoral, in force in the third
                                             country in question and the
                                             professional rules which are
                                             complied with in that country.
2. The Member States shall inform the     3. Member States shall inform the
   Commission of cases in which an           Commission of cases where they
   importing third country does not          consider that a third country does
   ensure an adequate level of               not ensure an adequate level of
   protection.                               protection.
3. Where the Commission finds, either     4. Where the Commission finds, either
   on the basis of information               on the basis of information
   supplied by Member States or on           supplied by Member States or on
   the basis of other information,           the basis of other information,
   that a third country does not have        that a third country does not
   an adequate level of protection            ensure an adequate level of
   and that the resulting situation           protection and that the resulting
   is likely to harm the interests of         situation is likely to harm the
   the Community or of a Member               interests of the Community or of a
   State, it may enter into                   Member State, it may enter into
   negotiations with a view to                negotiations with a view to
   remedying the situation.                   remedying the situation.
 ---pagebreak---                                     - 107 -
4. The commission may decide, in          5. The Commission may decide, in
   accordance with the procedure laid        accordance with the procedure laid
   down in Article 30 (2) of this            down in Article 34(2) that a third
   Directive, that a third country           country ensures an adequate level
   ensures an adequate level of              of protection by reason of the
   protection by reason of the               international commitments it has
   international commitments it has          entered into or of its domestic
   entered into or of its domestic           law.
   law.
5. Measures taken pursuant to this        6. Measures taken pursuant to this
   Article shall be in keeping with          Article shall be in keeping with
   the obligations incumbent on the          the obligations incumbent on the
   Community by virtue of                    Community by virtue of
   international agreements, both            international agreements, both
   bilateral and multilateral,               bilateral and multilateral,
   governing the protection of               governing the protection of
   individuals in relation to the            persons with regard to the
   automatic processing of personal          automatic processing of personal
   data.                                     data.
 ---pagebreak---                                     - 108 -
              Article 25                               Article 27
              Derogation                           Particular measures
1. A Member State may derogate from       1. Subject to the second subparagraph
   Article 24 (1) in respect of a            of Article 26(1), a Member State
   given export on submission by the         may authorize a transfer or
   conroller of the file of                  category of transfers of personal
   sufficient proof that an adequate         data to a third country which does
   level of protection will be               not ensure an adequate level of
   provided. The Member State may            protection where the controller
   grant a derogation only after it          adduces sufficient justification
   has informed the Commission and           in particular in the form of
   the Member States thereof and in          appropriate contractual provisions
   the absence of notice of                  guaranteeing, especially, the
   opposition given by a Member State        effective exercise of data
   or the Commission within a period         subjects' rights.
   of 10 days.
2. Where notice of opposition is          2. The Member State shall inform the
   given, the Commission shall adopt         Commission and the other Member
   appropriate measures in accordance        States in good time of its
   with the procedure laid down in           proposal to grant authorization.
   Article 30 (2)
                                          3. If a Member State or the
                                             Commission objects before the
                                             authorization takes effect, the
                                             Commission shall take appropriate
                                             measures in accordance with the
                                             procedure laid down in
                                             Article 34(2).
 ---pagebreak--- - 109 -
                    CHAPTER V
                CODES OF CONDUCT
                    Article 28
                  National codes
      1. Member states may provide that
         codes of conduct drawn up by trade
         associations may make additional
         provision for the special features
         of particular sectors, subject to
         the national measures taken under
         this Directive.
      2. The draft codes shall be reviewed
         by the national supervisory
         authority, which shall ascertain
         whether or not they are justified
         and the representativeness of the
         organizations which prepared them.
         The authority shall seek the views
         of data subjects or their
         representatives.
      3. Member States shall ensure the
         official publication of codes
         which have been the subject of a
         favourable opinion on the part of
         the supervisory authority.
 ---pagebreak--- - 110 -
      4. Any extension or amendment of the
         codes shall be subject to
         identical procedures.
                     Article 29
                  Community codes
      1. Member States and the Commission
          shall encourage the trade
          associations concerned to
          participate in drawing up
          Community codes of conduct
          intended to contribute to the
          proper application of this
          Directive in the light of the
          specific characteristics of each
          sector.
       2. The Commission may, for the
          purposes of information, publish
          codes of conduct in the Official
          Journal of the European
          Communities, together with the
          opinion of the Working Party
          provided for in Article 31 on the
          content of the codes and the
          representativeness at Community
          level of the organizations which
           prepared them. The Working Party
          shall seek the views of data
          subjects or their representatives.
 ---pagebreak---                                     - Ill -
              CHAPTER IX                                CHAPTER VI
     SUPERVISORY AUTHORITIES AND                SUPERVISORY AUTHORITY AND
   NORKING PARTY ON THE PROTECTION                 WORKING PARTY ON THE
           OF PERSONAL DATA                     PROTECTION OF INDIVIDUALS
                                                    WITH REGARD TO THE
                                               PROCESSING OF PERSONAL DATA
              Article 26                                Article 30
        Supervisory authority                     Supervisory authority
1. The Member States shall ensure         1. Each Member State shall designate
   that an independent competent             an independent public authority to
   authority supervises the                  supervise the protection of
   protection of personal data. The          personal data. The authority shall
   authority shall monitor the               be responsible for monitoring the
   application of the national               application of the national
   measures taken pursuant to this           provisions adopted pursuant to
   Directive and perform all the             this Directive and for performing
   functions that are entrusted to it        all the functions entrusted to it
   by this Directive.                        by this Directive.   Each
                                             Member State may designate more
                                             than one supervisory authority.
 ---pagebreak---                                     - 112 -
2. The authority shall have               2. Each supervisory authority shall
   investigative powers and effective         have:
   powers of intervention against the         - investigative powers including
   creation and exploitation of files            the right of access to data
   which do not conform with this                forming the subject-matter of
   Directive. To that end, it shall              processing operations covered by
   have inter alia the right of                  this Directive and the right to
   access to files covered by this               collect all the information
   Directive and shall be given the              necessary for the performance of
   power to gather all the                       its supervisory duties;
   information necessary for the              - effective powers of intervention
   performance of its supervisory                such as ordering the blocking or
   duties.                                       erasure of data, a temporary or
                                                 definitive ban on processing or
                                                 the destruction of data
                                                 material, or warning the
                                                 controller;
                                               - the power to bring an action
                                                  before the courts where it finds
                                                  that the national provisions
                                                  implementing this Directive have
                                                  been infringed.
 3. Complaints in connection with the      3. Each supervisory authority shall
    protection of individuals in               hear complaints lodged by any
    relation to personal data may be           person concerning the protection
    lodged with the authority by any           of persons with regard to the
    individual.                                processing of personal data. The
                                               person concerned shall be informed
                                               of the outcome of the complaint.
                                            4. Each supervisory authority shall
                                                produce an annual report.  The
                                                report shall be made public.
 ---pagebreak---                                     - 113 -
                                          5. Member States' authorities shall
                                             cooperate with one another to the
                                             extent necessary for the
                                             performance of their supervisory
                                             duties, inter alia by exchanging
                                             useful information or exercising
                                             their powers of investigation or
                                             intervention.
                                          6. Member States shall provide that
                                             the supervisory authority, its
                                             members and its staff are to be
                                             subject to a duty of confidence.
              Article 27                                Article 31
   Working Party on the Protection           Working Party on the Protection
           of Personal Data                   of Individuals with regard to
                                             the Processing of Personal Data
1. A Working Party on the Portection      1. A Working Party on the Protection
   of Personal Data is hereby set up.        of Individuals with regard to the
   The Working Party, which shall            Processing of Personal Data,
   have advisory status and shall act        hereinafter referred to as "the
   independently, shall be composed          Working Party", is hereby set up.
   of reprc.^ntatives of the                 The Working Party, which shall
   supervisory authorities provided          have advisory status, shall act
   for in Article 26 of all the              independently. It shall be
   Member States and shall be chaired        composed of representatives of the
   by a representative of the                supervisory authorities provided
   Commission.                               for in Article 30 and of a
                                             representative of the Commission.
 ---pagebreak---                                  - 114 -
                                          Where a Member State designates
                                          more than one supervisory
                                          authority, those authorities shall
                                          appoint joint representatives who,
                                          within the Working Party, shall
                                          have the same rights and
                                          obligations as the other
                                          representatives of the other
                                          authorities.
                                       2. The Working Party shall elect its
                                          chairman.    The chairman's term of
                                           office shall be two years.   His
                                           appointment shall be renewable.
The secretariat of the Working         3. The Working Party's secretariat
Party on the Protection of                 shall be provided by the
Personal Data shall be provided by         Commission.
the Commission's departments.
The Working Party on the               4. The Working Party shall adopt its
Protection of Personal Data shall          own rules of procedure.
adopt its own rules of procedure.
The Working Party on the                5. The Working Party shall consider
Protection of Personal Data shall           items placed on its agenda by its
examine questions placed on the            chairman, either on his own
agenda by its chairman, either on           initiative or at the reasoned
his own initiative or at the                request of a representative of the
reasoned request of a                       supervisory authorities, or at the
representative of the supervisory           Commission's request.
authorities, concerning the
 application of the provisions of
 Community law on the protection of
 personal data.
 ---pagebreak---                                     - 115 -
              Article 28                               Article 32
    Tasks of the Working Party on              Tasks of the Working Party
   the Protection of Personal Data
1. The Working Party on the               1. The Working Party shall:
   Protection of Personal Data shall:
(a) contribute to the uniform             (a) contribute to the uniform
    application of the national rules         application of the national
    adopted pursuant to this                  measures taken under this
    Directive;                                Directive;
(b) give an opinion on the level of       (b) give an opinion on the level of
    protection in the Community and           protection in the Community and
    in third countries;                       in third countries;
(c) advise the Commission on any          (c) advise the Commission on any
    draft additional or specific              proposed amendment of this
    measures to be taken to safeguard         Directive, on any additional or
    the protection of privacy.                specific measures to safeguard
                                              the rights and freedoms of
                                              natural persons and on any other
                                              proposed measures affecting such
                                              rights and freedoms;
                                          (d) give an opinion on codes of
                                              conduct drawn up at Community
                                              level.
 ---pagebreak---                                   - 116 -
If the Working Party on the             2. If the Working Party finds that
Protection of Personal Data finds          serious divergences are arising
that significant divergences are           between the laws or practices of
arising between the laws or                Member States concerning the
practices of the Member States in          protection of persons with regard
relation to the protection of              to the processing of personal data
personal data which might affect           and that those divergences might
the equivalence of protection in           affect the equivalence of
the Community, it shall inform the         protection in the Community, it
Commission accordingly.                    shall inform the Commission
                                           accordingly.
The Working Party on the                3. The Working Party may, on its own
Protection of Personal Data may             initiative, make recommendations
formulate recommendations on any           on all matters relating to the
questions concerning the                    protection of persons with regard
protection of individuals in                to the processing of personal data
relation to personal data in the            in the Community.
Community. The recommendations
 shall be recorded in the minutes
 and may be transmitted to the
 Advisory Committee referred to in
 Article 30. The Commission shall
 inform the Working Party on the
 Protection of Personal Data of the
 action it has taken in response to
 the recommendations.
                                         4. The Working Party's opinions and
                                            recommendations shall be recorded
                                            in its minutes and shall be
                                            transmitted to the Commission;
                                             they may also be transmitted to
                                             the advisory committee referred to
                                             in Article 34.
 ---pagebreak---                                     - 117 -
                                          5. The Commission shall inform the
                                             Working Party of the action it has
                                             taken in response to its opinions
                                             and recommendations.  It shall do
                                             so in a report which shall also be
                                             transmitted to the European
                                             Parliament and to the Council.
                                             The report shall be made public.
4. The Working Party on the               6. The Working Party shall draw up an
   Protection of Personal Data shall         annual report on the situation
   draw up an annual report on the           regarding the protection of
   situation regarding the protection        natural persons with regard to the
   of individuals in relation to the         processing of personal data in the
   processing of personal data in the        Community and in third countries,
   Community and in third countries,         which it shall transmit to the
   which it shall transmit to the            Commission, the European
   Commission.                               Parliament and the Council.  The
                                             report shall be made public.
 ---pagebreak---                                     - 118 -
               CHAPTER Χ                                CHAPTER VII
RULE-MAKING POWERS OF THE COMMISSION      RULE-MAKING POWERS OF THE COMMISSION
              Article 29                                 Article 33
    Exercise of rule-making powers            Exercise of rule-making powers
The Commission shall, in accordance       The Commission shall, in accordance
with the procedure laid down in           with the procedure laid down in
Article 30 (2), adopt such technical      Article 34(2), adopt such technical
measures as are necessary to apply        measures as are necessary to apply
this Directive to the specific            this Directive to the specific
characteristics of certain sectors        characteristics of particular sectors
having regard to the state of the art     or classes of processing, and the
in this field and to the codes of         measures necessary to ensure the
conduct.                                  consistent application of this
                                          Directive.
               Article 30                                 Article 34
           Advisory Committee                        Advisory Committee
 1. The Commission shall be assisted       1. The Commission shall be assisted
    by a Committee of an advisory             by a committee of an advisory
    nature composed of the                    nature composed of the
    representatives of the Member             representatives of the
    States and chaired by a                   Member States and chaired by a
    representative of the Commission.         representative of the Commission.
 ---pagebreak---                                     - 119 -
2. The representative of the              2. The representative of the
   Commission shall submit to the            Commission shall submit to the
   Committee of draft of the measures        committee a draft of the measures
   to be taken. The Committee shall          to be taken.  The committee shall
   deliver its opinion on the draft          deliver its opinion on the draft
   within a time limit which the             within a time limit which the
   chairman may lay down according to        chairman may lay down according to
   the urgency of the matter, if             the urgency of the matter, if
   necessary by taking a vote. The           necessary by taking a vote.
   opinion shall be recorded in the
   minutes; in addition, each Member         The opinion shall be recorded in
   State shall have the right to ask         the minutes; in addition each
   to have its position recorded in          Member State shall have the right
   the minutes. The Commission shall         to ask to have its position
   take the utmost account of the            recorded in the minutes.
   opinion delivered by the
   Committee. It shall inform the            The Commission shall take the
   Committee of the manner in which          utmost account of the opinion
   its opinion has been taken into           delivered by the committee.  It
   account.                                  shall inform the committee of the
                                             manner in which its opinion has
                                             been taken into account.
 ---pagebreak---                                     - 120 -
          FINAL PROVISIONS                          FINAL PROVISIONS
             Article 31                                Article 35
1. The Member States shall bring into     1. Member States shall bring into
   force the laws, regulations and           force the laws, regulations and
   administrative provisions                 administrative provisions
   necessary for them to comply with         necessary to comply with this
   this Directive by 1 January 1993.         Directive by 1 July 1994.
The provisions adopted pursuant to           When Member States adopt these
the first subparagraph shall make            provisions, these shall contain a
express reference to this Directive.         reference to this Directive or
                                             shall be accompanied by such
                                             reference at the time of their
                                             official publication.  The
                                             procedure for such reference shall
                                             be adopted by Member States.
                                          2. Member States shall set a date
                                             after which processing operations
                                             which began before 1 July 1994
                                             must be compatible with the
                                             national provisions adopted
                                             pursuant to this Directive; the
                                             date set may be no later than
                                             30 June 1997.
 ---pagebreak---                                     - 121 -
2. The Member States shall                3. Member States shall communicate to
   communicate to the Commission the         the Commission the texts of the
   texts of the provisions of                provisions of national law which
   national law which they adopt in          they adopt in the field covered by
   the field covered by this                 this Directive.
   Directive.
              Article 32                                Article 36
The Commission shall report to the        The commission shall report to the
Council and the European Parliament       Council and the European Parliament
at regular intervals on the               at regular intervals on the
implementation of this Directive,         implementation of this Directive,
attaching to its report, if               attaching to its report, if
necessary, suitable proposals for         necessary, suitable proposals for
amendments.                               amendments.  The report shall be made
                                          public.
              Article 33                                Article 37
This Directive is addressed to the        This Directive is addressed to the
Member States.                            Member States.
Done at Brussels,                         Done at Brussels,     For the Council
For the Council                                                  The President
 ---pagebreak---                                     - 122 -
                             FINANCIAL STATEMENT
Section 1:  Financial implications
1.   Title of operation:        Amended proposal for a Council Directive on
                                the protection of individúale with regard to
                                the processing of personal data and on the
                                free movement of such data
2.   Budget headings involved
-    A 2510:   Expenditure on meetings of committees whose consultation is
               compulsory   in    the   procedure  for    drafting  Community
               legislation.
     A 2511:   Expenditure on meetings of committees whose consultation is
               not compulsory in the procedure for drafting Community
               legislation.
     Titles Al and A2: Staff and operating expenditure
3.   Legal basis
Article 100a of the EEC Treaty
 4.   Description of operation:
      Objectives: -  to permit the proper functioning of the internal market
                     by ensuring the free movement of personal data within
                     the Community;
                   - to ensure the protection of individuals with regard to
                      personal data.
      Setting-up of two bodies responsible for the protection of individuals
      with regard to personal data (Articles 31 and 34).
      Persons concerned:
      1. In the case of the Working Party on the Protection of Individuals
         with regard to the Processing of Personal Data (Article 31):
         representatives of the supervisory authorities of all the
         Member States (Group 4).
      2. In    the   case    of    the    Advisory   Committee   (Article 34):
         representatives of the Member States (Group 3).
 ---pagebreak---                                   - 123 -
        The Advisory Committee will be chaired by a representative of the
        Commission. The chairman of the Working Party on the Protection of
        Personal Data will be a member elected for two years. The
        secretariat of the Advisory Committee and of the Working Party on
        the Protection of individuals with regard to the Processing of
        Personal Data will be provided by the Commission.
5.   Classification of expenditure
5.1  Non-compulsory
5.2  Non-differentiated
6.   Type of expenditure
-    Costs incurred by members attending meetings of the Working Party and
     the Advisory Committee;
-    staff costs.
7.   Financial impact on appropriations for operations
None
8.   What anti-fraud    measures are  planned   in  the  proposal  for  the
operation?
None
Section 2: Administrative expenditure (part A of the budget)
1.   Will the proposed operation involve an increase in the number of
     Commission staff? Yes: two C-grade officials.
     These posts will be obtained either as part of the allocation of
     resources decided by the Commission on the basis of future budgets or
     by internal redeployment.
2.   Amount of expenditure involved:
     Secretariat:   around ECU 120 000 a year charged to the various budget
                    headings in Titles Al and A2 (two C officials).
-    Meetings of bodies:
     *  Working Party on the Protection of Individuals with regard to the
        Processing of Personal Data:
        24 members (non-governmental) χ 4 meetings of 2 days:
 ---pagebreak---                                    - 124 -
           travel expenses:    ECU 526.61 χ 24 χ 4     = ECU 50 555
        -  allowance for
           travelling time:    ECU 105.40 χ 24 χ 4     = ECU 10 118
           daily expenses:     ECU 105.40 χ 24 χ 4 χ 2 = ECU 20 236
                                                         ECU 80 909
     * Advisory Committee
        24 members (governmental) χ 2 meetings of 2 days:
        - travel expenses   : ECU 526.61 χ 24 χ 2 = ECU 25 277
        Rounded total for a full year:
        - secretariat          ECU 120 000
        - Working Party        ECU 81 000
        - Advisory Committee   ECU 25 000
        TOTAL ECU 226 000
Section 3;   Elements of cost-effectiveness analysis
1.   objective and coherence with financial programming
Two bodies are to be set up which will be authorized to meet as from 1994.
They will be included in the list of committees for the 1994 financial
programming.
The timetable for commitment and payment appropriations (non-compulsory,
non-differentiated) is as follows:
            Commitment appropriations - Payment appropriations
1994           ECU 226 000
1995           ECU 226 000
1996           ECU 226 000
1997           ECU 226 000
1998           ECU 226 000
The appropriations are to be obtained from the various headings of part A
under the general budgetary procedure.
 2.   Grounds for the operation
(a)   The Working Party on the Protection of Individuals with regard to the
      Processing of Personal Data (Article 31)
      This Working Party has advisory status and will act independently. It
      will be composed of representatives of the supervisory authorities o
      all the Member States.
 ---pagebreak---                                  - 125 -
    It will adopt its own rules of procedure.        The Working  Party's
    secretariat will be provided by the Commission.
    Tasks of the Working Party: see Article 32. It will advise the
    Commission on any proposed additional measures by giving a completely
    independent opinion (a fundamental principle in the protection of
    privacy).
3.  Monitoring and evaluation of the operation
3.1 Indicators: analysis of the annual report presented by the Working
    Party pursuant to Article 32(6).
3.2 Details and frequency: each year on the basis of the above-mentioned
    report to be presented by the Working Party.
3.3 The main factors of uncertainty will concern the difficulties of
    harmonizing the different approaches and degrees of experience in the
    Member States. These differences stem from various factors, e.g. of a
    cultural or technical nature.
 ---pagebreak---                                     - 126 -
                            IMPACT ASSESSMENT FORM
             THE IMPACT OF THE PROPOSAL ON BUSINESS AND ON OTHER
            BODIES CONCERNED, WITH SPECIAL REFERENCE TO SMALL AND
                        MEDIUM-SIZED ENTERPRISES (SMES)
Title of proposal:    Amended proposal for a Council Directive on the
                      protection of individuals with regard to the processing
                      of personal data and on the free movement of such data
Reference number:
THE PROPOSAL
1.    Taking account of the principle of subsidiarity, why is Community
      legislation necessary in this area and what are its main aims?
Flows of personal data between bodies operating in the various spheres of
economic and social activity in the Member States and the processing of
such data by those bodies are expanding rapidly precisely because of the
completion of the internal market:
      flows between private or public enterprises;
 -    flows between units which are legally part of the same enterprise;
      flows between national administrations required to provide mutual
      assistance under various community instruments;
      flows to medical research centres, etc.
 The major differences that exist between national laws (it being borne in
 mind that four Member States still have no specific laws on data
 protection: Belgium, Greece, Italy and Spain) give rise to:
       obstacles to the free movement of personal data, particularly in the
       case of flows to a Member State with no specific laws on the matter,
       given that the aim of legislation in this area is to protect
       fundamental   rights   and  freedoms,   particularly  the   privacy  of
       individuals;
       distortions in competition between businesses in the Community, in
       that some are subject to protective legislation while others are not,
       depending on the Member State in which they are established.
  Moreover, the introduction of rules on data protection is likely t
  encourage the development of the information market through the legal
  certainty that these rules provide for the bodies concerned.
 ---pagebreak---                                    - 127 -
Action by the Community is therefore of fundamental importance. It must
take the form of an approximation of national laws. The Council of Europe
Convention of 28 January 19 81 for the protection of individuals with regard
to automatic processing of personal data, the only instrument of
international law in this area, leaves open a wide range of options for
applying the principles that it sets out and does not, therefore, allow a
sufficient degree of harmonization for the internal market.
THI; IMPACT ON BUSINESS, PUBLIC AUTHORITIES AND OTHER BODIES, INCLUDING
FOUNDATIONS AND ASSOCIATIONS
2.   who will be affected by the proposal?
The proposal covers, regardless of size or sector of activity, all public
and private enterprises, public administrations whose activities are
governed   by Community    law, and     foundations  and   non-profit-making
associations in so far as such bodies process personal data (management of
suppliers and customers, personnel management, management of members or
correspondents of associations and foundations, processing by bodies of
data on persons under their administration, provision of information on
individuals).
However, as the consultations referred to in point 6 have shown, the areas
of industry which will be particularly concerned by the application of this
Directive are businesses and bodies in the service sector whose activities
are aimed at individuals and are based on the processing of information:
direct marketing companies, financial institutions, insurance companies,
credit-rating agencies.
3.   What will business have to do to comply with the proposal?
Businesses will have to introduce decision-making and organizational
procedures that, depending on the structure and size of the concern,
involve the head of data processing and organization, the department using
such technologies, the legal service and the head of the organization.
Where new ways of processing personal data are being designed the
organization must, prior to the investment stage:
-    check that the proposed forms of data processing are lawful;
-    specify the information to be given to data subjects. Such
     information could be provided on the occasion of the usual contacts
     between the person in charge of processing (controller) and the data
     subjects;
     provide for the technical and organizational measures necessary to
     guarantee the security of data and processing;
 ---pagebreak---                                   - 128 -
     make sure of the notification procedure applicable. After collecting
     the necessary elements of information, the controller will establish
     that no notification is necessary, will carry out a simplified
     formality or will make up a file.
The controller must also ensure that a procedure is in place to handle any
requests for right of access by data subjects to data concerning them as
well as possible complaints, and take steps to monitor the proper
functioning of security measures.
These tasks are to be carried out in the course of new processing
operations and can therefore be planned in line with progress in devising
the technical processing procedures.
In the case of processing operations carried out before the entry into
force of national provisions taken in pursuance of the Directive, such
tasks may be planned over a period of three years, as laid down in the
Directive.
In the case of bodies established in Member States which already have
legislation in this area, the measures required by the Directive do not
differ in nature from those already implemented.
In the case of bodies established in Member States which do not have such
legislation, methods must be devised although the competent supervisory
authorities may be a great help during the launch phase (advice, simplified
notification procedure for certain processing operations, etc.).
4.   What economic effects is the proposal likely to have?
Protection of individual privacy, as guaranteed by the Directive, will
increase social acceptance of the use of the various ways of processing
personal data and hence acceptance of their development, this being a
factor which will promote growth and job creation in the private and public
sectors.
Moreover, these rules on protection are such as to eliminate the
distortions of competition arising from the present differences between
national laws. As regards international competitiveness, the Directive
provides for negotiations with third countries which are still unable to
guarantee an adequate level of protection.
5.    Does the proposal contain measures to take account of the specific
      situation of small and medium-sized firms?
No. However, it is reasonable to assume that most processing operations
carried out by SMEs will fall into those categories which, depending on the
system proposed, could be exempted from the notification requirement or
could benefit from a simplified procedure (with completion of these
formalities not involving more than a few hours' work). Moreover, the
Directive does not provide for any fee for the completion of notification
 formalities.
 ---pagebreak---                                    - 129 -
CONSULTATION
6.   List the organizations which have been consulted about the proposal
     and outline their main views
(a)  Interested parties were consulted primarily through the    Economic and
     Social Committee, which gave a favourable opinion on      the proposal
     (OJ No C 159 of 17 June 1991, p. 38), and through the      Committee on
     Commerce and Distribution (CCD) and the Consumers           Consultative
     Committee.
(b)  As regards the amended proposal, direct corcacts were held, at the
     initiative of the Commission departments or business interests
     concerned, with European business associations with regard to either
     the horizontal nature of the proposal (UNICE) or the sectors most
     affected, including the Banking Federation, CELD, FEWITA, GEDIS, the
     European    Federation    for     Direct    Marketing,   EAT,     CHANGE
     (non-profit-making bodies), the European Society for Opinion and
     Marketing Research, ACT, EPC, ENPA, CAEJ, EBU and FAEP (for the press
     and audiovisual aspects).
The main points raised by the business associations concerning the original
proposal were:
-    proposal too detailed;
     predominance of the data subject's consent as a condition for the
     processing of personal data;
-    exclusion of any possibility       of  computerized  decision   and  the
     preparation of profiles;
     onerous and inappropriate obligations with regard to informing the
     data subject and notifying the supervisory authorities;
     impossibility of conducting international trade with third countries
     not guaranteeing an adequate level of protection;
-    risk to freedom of expression if some Member States do not proceed
     with the derogations necessary to reconcile the rules on the exercise
     of that freedom with those on the protection of privacy.
The amended proposal has attempted to clarify or adapt the text where
necessary while continuing to pursue the objective of a high level of
protection, without which free movement would not be possible.
 ---pagebreak---                                                130 -
                                                                      ISSN 0254-1475
                                                               COM(92) 422 final
                                                      DOCUMENTS
EN                                                                               on
                                 Catalogue number : CB-CO-92-437-EN-C
                                                             ISBN 92-77-47942-6
Office for Official Publications of the European Communities
L-2985 Luxembourg